Networking is a critical component to plan and design before implementing any Azure products. Some networking options cannot be changed after implementation. For example, a new network cannot be added to an existing virtual machine. The virtual machine must be deleted/recreated (but disks from the original machine can be reused or restored from backups) in order to configure the new network.

This article provides an overview of all the networking options available in Microsoft Azure:
https://docs.microsoft.com/en-us/azure/networking/networking-overview

This article provides documentation and walkthroughs for virtual networks:
https://docs.microsoft.com/en-us/azure/virtual-network/

Network Security Groups help control access to networks in Microsoft Azure. This article provides an overview of them:
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview?toc=%2fazure%2fnetworking%2ftoc.json

Microsoft Azure ExpressRoute
ExpressRoute enables you to extend the campus network into the Microsoft cloud over a private connection facilitated by a connectivity provider. This connection works like a split tunnel VPN. Traffic bound for campus does not go over the public Internet.

More Information on ExpressRoute Azure, Networking ExpressRoute