How many subnets are necessary in Azure VNet for a WAN Edge device to function in the cloud deployment?

A single subnet is insufficient for a WAN Edge device because it needs distinct network segments for its external WAN connectivity and its internal service-side connectivity within the VNet.

While a separate management subnet can be created, it is not strictly a mandatory requirement for 'three subnets', as often management traffic is handled via the public or service interfaces or the cloud management plane.

While a public subnet is required, the statement that 'Microsoft underlay cloud fabric performs all of the routing functions' is incorrect; the WAN Edge device itself performs overlay routing, and it requires a service-side interface/subnet to connect to the internal virtual network.

In an Azure VNet deployment, a WAN Edge device typically requires at least two subnets: a public subnet for establishing VPN tunnel connections over the WAN (e.g., to the internet) and a service subnet for connecting to internal virtual machines or other VNets within Azure. The management function is usually integrated or flows over these interfaces within the Azure cloud environment.