Azure VM Losing Network Connectivity after Doomain Removal

The 0.0.0.0/0 → Azure Firewall UDR can remain. Domain membership does not affect Azure routing, and Microsoft documents this as a normal way to force workload traffic through Azure Firewall.

The most likely issue is the Windows network profile/firewall changing when the server leaves AD. Once it is no longer domain joined, the Domain firewall profile no longer applies and Windows commonly switches the NIC to Public. Any RDP or management rules that only existed for the Domain profile then stop working.

I would check these immediately after the unjoin:

Get-NetConnectionProfile Get-NetFirewallProfile Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Select DisplayName, Enabled, Profile

Then test the actual connectivity rather than relying on the network icon:

Test-NetConnection 168.63.129.16 -Port 53 Test-NetConnection 8.8.8.8 -Port 443 Resolve-DnsName microsoft.com Test-NetConnection <Azure-Firewall-Private-IP>

The flashing/no-internet network icon can simply mean Windows NCSI cannot complete its internet connectivity test; it doesn't necessarily mean the NIC has lost Azure connectivity.

I would also temporarily enable RDP for the Private profile:

Set-NetConnectionProfile -NetworkCategory Private Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

I would not disable NLA permanently. That is unlikely to fix the underlying problem.

Also check Azure Firewall logs immediately after the domain removal. If DNS or outbound HTTPS starts getting denied, that will normally expose the problem very quickly. Changing the NIC to Azure-provided DNS is fine provided the server no longer needs your AD DNS/private DNS zones.

Finally, your Server 2025 goal is supported: Azure Windows Server VMs can use Microsoft Entra sign-in and become Microsoft Entra joined using the Azure VM Entra authentication capability.

So my suspicion order would be: Windows Firewall profile → DNS resolution → Azure Firewall rules/logs → effective routes, rather than rebuilding the Azure NIC.