diff --git a/upup/pkg/fi/cloudup/azure/azure_cloud.go b/upup/pkg/fi/cloudup/azure/azure_cloud.go
index 9fdbb16e5e..310204e466 100644
--- a/upup/pkg/fi/cloudup/azure/azure_cloud.go
+++ b/upup/pkg/fi/cloudup/azure/azure_cloud.go
@@ -43,6 +43,8 @@ type AzureCloud interface {
 
 	AddClusterTags(tags map[string]*string)
 
+	FindVNetInfo(id, resourceGroup string) (*fi.VPCInfo, error)
+
 	SubscriptionID() string
 	ResourceGroup() ResourceGroupsClient
 	VirtualNetwork() VirtualNetworksClient
@@ -114,7 +116,31 @@ func (c *azureCloudImplementation) DNS() (dnsprovider.Interface, error) {
 }
 
 func (c *azureCloudImplementation) FindVPCInfo(id string) (*fi.VPCInfo, error) {
-	return nil, errors.New("FindVPCInfo not implemented on azureCloud")
+	return nil, errors.New("FindVPCInfo not implemented on azureCloud, use FindVNETInfo instead")
+}
+
+func (c *azureCloudImplementation) FindVNetInfo(id, resourceGroup string) (*fi.VPCInfo, error) {
+	vnets, err := c.vnetsClient.List(context.TODO(), resourceGroup)
+	if err != nil {
+		return nil, err
+	}
+	for _, vnet := range vnets {
+		if *vnet.ID != id {
+			continue
+		}
+		subnets := make([]*fi.SubnetInfo, 0)
+		for _, subnet := range *vnet.Subnets {
+			subnets = append(subnets, &fi.SubnetInfo{
+				ID:   *subnet.ID,
+				CIDR: *subnet.AddressPrefix,
+			})
+		}
+		return &fi.VPCInfo{
+			CIDR:    (*vnet.AddressSpace.AddressPrefixes)[0],
+			Subnets: subnets,
+		}, nil
+	}
+	return nil, nil
 }
 
 func (c *azureCloudImplementation) DeleteInstance(i *cloudinstances.CloudInstance) error {
diff --git a/upup/pkg/fi/cloudup/azuretasks/testing.go b/upup/pkg/fi/cloudup/azuretasks/testing.go
index 9edc065213..c457c26590 100644
--- a/upup/pkg/fi/cloudup/azuretasks/testing.go
+++ b/upup/pkg/fi/cloudup/azuretasks/testing.go
@@ -122,6 +122,10 @@ func (c *MockAzureCloud) FindVPCInfo(id string) (*fi.VPCInfo, error) {
 	return nil, errors.New("FindVPCInfo not implemented on azureCloud")
 }
 
+func (c *MockAzureCloud) FindVNetInfo(id, resourceGroup string) (*fi.VPCInfo, error) {
+	return nil, errors.New("FindVNetInfo not implemented on azureCloud")
+}
+
 // DeleteInstance deletes the instance.
 func (c *MockAzureCloud) DeleteInstance(i *cloudinstances.CloudInstance) error {
 	return errors.New("DeleteInstance not implemented on azureCloud")
diff --git a/upup/pkg/fi/cloudup/defaults.go b/upup/pkg/fi/cloudup/defaults.go
index d054117522..05d1be5f0f 100644
--- a/upup/pkg/fi/cloudup/defaults.go
+++ b/upup/pkg/fi/cloudup/defaults.go
@@ -24,6 +24,7 @@ import (
 	"k8s.io/klog/v2"
 	"k8s.io/kops/pkg/apis/kops"
 	"k8s.io/kops/upup/pkg/fi"
+	"k8s.io/kops/upup/pkg/fi/cloudup/azure"
 	"k8s.io/kops/upup/pkg/fi/cloudup/gce"
 	"k8s.io/kops/util/pkg/vfs"
 
@@ -56,20 +57,31 @@ func PerformAssignments(c *kops.Cluster, cloud fi.Cloud) error {
 		}
 	}
 
-	// Currently only AWS uses NetworkCIDRs
-	setNetworkCIDR := (cloud.ProviderID() == kops.CloudProviderAWS) || (cloud.ProviderID() == kops.CloudProviderALI)
+	setNetworkCIDR := (cloud.ProviderID() == kops.CloudProviderAWS) || (cloud.ProviderID() == kops.CloudProviderALI) || (cloud.ProviderID() == kops.CloudProviderAzure)
 	if setNetworkCIDR && c.Spec.NetworkCIDR == "" {
 		if c.SharedVPC() {
-			vpcInfo, err := cloud.FindVPCInfo(c.Spec.NetworkID)
-			if err != nil {
-				return err
+			var vpcInfo *fi.VPCInfo
+			var err error
+			if cloud.ProviderID() == kops.CloudProviderAzure {
+				if c.Spec.CloudConfig == nil || c.Spec.CloudConfig.Azure == nil || c.Spec.CloudConfig.Azure.ResourceGroupName == "" {
+					return fmt.Errorf("missing required --azure-resource-group-name when specifying Network ID")
+				}
+				vpcInfo, err = cloud.(azure.AzureCloud).FindVNetInfo(c.Spec.NetworkID, c.Spec.CloudConfig.Azure.ResourceGroupName)
+				if err != nil {
+					return err
+				}
+			} else {
+				vpcInfo, err = cloud.FindVPCInfo(c.Spec.NetworkID)
+				if err != nil {
+					return err
+				}
 			}
 			if vpcInfo == nil {
-				return fmt.Errorf("unable to find VPC ID %q", c.Spec.NetworkID)
+				return fmt.Errorf("unable to find Network ID %q", c.Spec.NetworkID)
 			}
 			c.Spec.NetworkCIDR = vpcInfo.CIDR
 			if c.Spec.NetworkCIDR == "" {
-				return fmt.Errorf("unable to infer NetworkCIDR from VPC ID, please specify --network-cidr")
+				return fmt.Errorf("unable to infer NetworkCIDR from Network ID, please specify --network-cidr")
 			}
 		} else {
 			if cloud.ProviderID() == kops.CloudProviderAWS {