Azure Port TCP 25 Outbound for SMTP

The TCP port 25 authorization shown is attached to the subscription, so it should remain applicable when the VM moves from Southeast Asia to Indonesia Central within that same subscription; the destination VM must still have a direct Internet route and network rules permitting TCP 25.

What carries over

Your diagnostic explicitly reports that the Azure in CSP subscription is authorized to send mail over TCP 25. The authorization is therefore not tied to:

• The source VNet or subnet
• An NSG
• The VM’s public IP address
• Southeast Asia specifically

Microsoft’s documented exemption model likewise applies the exemption to the requested subscription and to VM traffic routed directly to the Internet—not to a particular VM, VNet, or public IP.^1^

Keep the VM in the same subscription during relocation. Resource Mover only supports cross-region relocation within the same subscription; cross-subscription moves are a separate Azure Resource Manager operation.^2^

What must be revalidated in Indonesia Central

1. Create or select the destination networking resources.
   During Resource Mover’s Prepare stage, select existing target-region resources or create the destination NIC, VNet, NSG, and public IP as required.^3^
2. Check the effective outbound NSG rules.
   Ensure no higher-priority rule on the destination NIC or subnet denies:
   • Direction: Outbound
   • Protocol: TCP
   • Destination port: 25
   • Destination: the SMTP server, or the required Internet range
   An NSG can allow or deny traffic independently of the platform-level SMTP authorization. Rules are evaluated by priority, and the first matching rule determines the result.^4^
3. Validate the actual outbound route.
   The subscription exemption applies only when VM traffic routes directly to the Internet.^1^ Review the destination NIC’s Effective routes and check whether 0.0.0.0/0 instead sends traffic through:
   • Azure Firewall
   • A network virtual appliance
   • VPN or ExpressRoute to an on-premises network
   • Another centralized egress service
   If so, TCP 25 must also be permitted by that egress path, and the documented direct-Internet exemption behavior should not be assumed.
4. Expect a different public IP.
   Public IP resources are regional, so the original address is not retained across the move.^3^ After relocation:
   • Identify the new outbound public IP.
   • Update SMTP-server allowlists, DNS records, monitoring, and external integrations.
   • Verify reverse-DNS and sender-reputation requirements with the receiving mail provider.
   A changed public IP does not remove the subscription authorization, but it can affect recipient acceptance or filtering.^5^
5. Stop/deallocate and restart if the target VM does not pick up the policy.
   Microsoft documents stop/deallocate followed by restart as the way VMs receive a newly granted TCP 25 network policy.^1^ Your diagnostic recommends the same refresh. Afterward, test against the intended SMTP endpoint rather than testing only general Internet connectivity.

Recommended post-move test

From the relocated VM, test the actual mail server and inspect the SMTP banner:

Test-NetConnection smtp.contoso.com -Port 25

A successful TCP test confirms connectivity, not mail delivery. If TCP connects but messages are rejected or filtered, investigate the new egress IP’s reputation and the recipient provider’s policy. Microsoft recommends authenticated SMTP relay, typically over TCP 587, because it is unrestricted across subscription types and provides more reliable delivery.^1^

References

1. Troubleshoot outbound SMTP connectivity problems in Azure
2. Common questions
3. Support for moving Azure VMs between Azure regions
4. Azure network security groups overview
5. Azure virtual machine region relocation changes public IP behavior and the original public IP isn't retained