How should Azure Virtual Network be designed for production in Microsoft Azure?

Plan address space early, segment subnets by responsibility, use NSGs and route tables intentionally, prefer private endpoints for sensitive PaaS services, and document DNS behavior.