As you are probably aware, Microsoft is going to turn off default outbound access (read the announcement https://azure.microsoft.com/en-us/updates/default-outbound-access-for-vms-in-azure-will-be-retired-transition-to-a-new-method-of-internet-access/).
As part of the recommendations to move from default (implicit) outbound access to explicit outbound access, a new network capability has been added called Private subnet.
The private subnet will prevent this implicit access by setting the “default outbound access” to false.
Enabling a private subnet can only be done when creating a new subnet. At this stage (probably a preview limitation), you can not set it for existing subnet.
In addition (also probably a limitation of the preview), the option is only available when creating new virtual network.
When setting a subnet as private, you will have to define an explicit outbound (see the recommendations from the above link).
