redpanda-data · ppanagiotis · Jul 21, 2026
@@ -486,6 +486,8 @@
 *** xref:networking:byoc/azure/index.adoc[Azure]
 **** xref:networking:azure-private-link-in-ui.adoc[]
 **** xref:networking:azure-private-link.adoc[]
+**** xref:networking:byoc/azure/nat-free-egress.adoc[Configure Centralized Egress]
+**** xref:networking:byoc/azure/azure-hub-egress.adoc[Create an Azure Hub for Centralized Egress]
 *** xref:networking:byoc/gcp/index.adoc[GCP]
 **** xref:networking:byoc/gcp/vpc-peering-gcp.adoc[Add a Peering Connection]
 **** xref:networking:configure-private-service-connect-in-cloud-ui.adoc[Configure Private Service Connect in the Cloud Console]

@@ -400,7 +400,7 @@ The following features are currently in beta in Redpanda Cloud:
 
 * BYOVNet for Azure
 * Secrets management for BYOVPC on GCP
-* Centralized egress for BYOC on AWS and GCP
+* Centralized egress for BYOC on AWS, GCP, and Azure
 * Several Redpanda Connect components
 
 include::shared:partial$suggested-video.adoc[]

@@ -169,6 +169,11 @@ Optionally, click *Advanced settings* to specify up to five key-value custom tag
 Private access incurs an additional cost, since it involves deploying two network load balancers, instead of one. 
 +
 NOTE: After the cluster is created, you can change the API Gateway access on the Dataplane settings page. If you change from public to private access, users without VPN access to the Redpanda VPC will lose access to these services.
++
+[TIP]
+====
+To route all cluster egress through your own Azure Firewall and hub VNet instead of a per-cluster NAT Gateway, set `egress_spec.azure.hub_vnet_id` and `egress_spec.azure.firewall_private_ip` when you create the network with the Cloud API. This option is only available on clusters with a private connection type and a Redpanda-managed VNet, and is only enabled if centralized egress is enabled for your organization. This option is in beta and does not yet have Cloud UI support. See xref:networking:byoc/azure/nat-free-egress.adoc[].
+====
 . Click *Next*.
 . On the Deploy page, follow the steps to log in to Redpanda Cloud and deploy the agent.
 +

@@ -8,6 +8,10 @@ This page lists new features added to Redpanda Cloud.
 
 == July 2026
 
+=== Centralized egress for BYOC on Azure: beta
+
+You can route all Azure BYOC cluster egress through your own Azure Firewall and hub VNet instead of a per-cluster NAT Gateway, so outbound traffic exits through your centralized inspection point. This is useful for regulated environments that require a single, predictable public IP for outbound allowlisting or that prohibit per-cluster NAT Gateways. Centralized egress is in a glossterm:beta[] release, is enabled per organization, and is configured through the Cloud API. Contact your account team for access. See xref:networking:byoc/azure/nat-free-egress.adoc[Configure Centralized Egress with Azure Firewall].
+
 === Improved Serverless trial onboarding
 
 New Serverless free-trial users now get a guided start in the Redpanda Cloud UI. After you sign up, a few quick questions help Redpanda tailor your experience. The welcome cluster's *Overview* page summarizes your trial credits, and the *Get started* button offers options to start streaming: create a Redpanda Connect pipeline, use `rpk` from the command line, or connect with your own Kafka client. See xref:get-started:cluster-types/serverless.adoc#get-started-with-serverless[Get started with Serverless].

@@ -133,7 +133,9 @@ curl -d \
 // To enable, set the attribute in the playbook or in this page header.
 // The GCP BYOC network example adds `egress_spec.gcp.hub_vpc_project` and
 // `egress_spec.gcp.hub_vpc_name` for centralized egress through a hub VPC.
-// Also gated behind `:show-preview-api:`.
+// The Azure BYOC network example adds `egress_spec.azure.hub_vnet_id` and
+// `egress_spec.azure.firewall_private_ip` for centralized egress through a
+// hub VNet and Azure Firewall. All are gated behind `:show-preview-api:`.
 ifdef::show-preview-api[]
 
 To route all cluster egress through your own AWS Transit Gateway and hub VPC instead of a per-VPC NAT Gateway, set `egress_spec.aws.transit_gateway_id` on an AWS BYOC network. Centralized egress is in beta. Before calling this endpoint, provision the hub VPC and Transit Gateway and share the Transit Gateway with the Redpanda cluster account. See xref:networking:byoc/aws/aws-hub-egress.adoc[Create an AWS Hub for Centralized Egress] and xref:networking:byoc/aws/nat-free-egress.adoc[Configure Centralized Egress with AWS Transit Gateway].
@@ -182,6 +184,30 @@ curl -d \
 }' -H "Content-Type: application/json" \
 -H "Authorization: Bearer <token>" -X POST https://api.redpanda.com/v1/networks
 ----
+
+To route all cluster egress through your own Azure Firewall and hub VNet instead of a per-cluster NAT Gateway, set `egress_spec.azure.hub_vnet_id` and `egress_spec.azure.firewall_private_ip` on an Azure BYOC network. Centralized egress is in beta. Before calling this endpoint, provision the hub VNet, Azure Firewall, and VNet peering. See xref:networking:byoc/azure/azure-hub-egress.adoc[Create an Azure Hub for Centralized Egress] and xref:networking:byoc/azure/nat-free-egress.adoc[Configure Centralized Egress with Azure Firewall].
+
+[,bash]
+----
+curl -d \
+'{
+  "network": {
+    "cidr_block": "10.0.0.0/20",
+    "cloud_provider": "CLOUD_PROVIDER_AZURE",
+    "cluster_type": "TYPE_BYOC",
+    "name": "<network-name>",
+    "resource_group_id": "<resource-group-id>",
+    "region": "eastus2",
+    "egress_spec": {
+      "azure": {
+        "hub_vnet_id": "/subscriptions/<hub-subscription-id>/resourceGroups/hub-egress-rg/providers/Microsoft.Network/virtualNetworks/hub-vnet",
+        "firewall_private_ip": "10.255.0.4"
+      }
+    }
+  }
+}' -H "Content-Type: application/json" \
+-H "Authorization: Bearer <token>" -X POST https://api.redpanda.com/v1/networks
+----
 endif::[]
 endif::[]