All Azure virtual machines run in the context of a virtual network that provides at least internet access to the VM. The virtual network appears to the VM as a LAN with a DHCP, DNS, and gateway, and is separated from the internet by a firewall that permits only outgoing traffic from the virtual network to the internet. Incoming traffic to a VM is provided through endpoints to tunnel external ports on a virtual public IP (VIP) to the internal ports of the VM. A VM only knows its internal IP address on the virtual network and has no knowledge of the external virtual IP. By default a VM can be created with a virtual network that serves the VM exclusively and is otherwise isolated, but Azure also provides the ability to manage custom virtual networks that can accommodate multiple VMs in a common LAN environment, with custom DNS and DHCP subnet range assignments. You can also establish VPN connections to the virtual network to bridge your local network (site-to-site or STS VPN) or connect from independent workstations (point-to-site or PTS VPN).
Virtual network configuration for a VM can only be established when creating the VM -- a VM cannot subsequently be reconfigured to join a different virtual network.
For more information, see https://msdn.microsoft.com/en-.../azure/dn133803.aspx