diff --git a/controller/aks-cluster-config-handler.go b/controller/aks-cluster-config-handler.go
index bd0a7721..7c45c9ed 100644
--- a/controller/aks-cluster-config-handler.go
+++ b/controller/aks-cluster-config-handler.go
@@ -982,7 +982,7 @@ func (h *Handler) updateUpstreamClusterState(ctx context.Context, config *aksv1.
 				if config.Status.Phase != aksConfigUpdatingPhase {
 					return h.enqueueUpdate(config)
 				}
-				err = aks.CreateOrUpdateAgentPool(ctx, h.azureClients.agentPoolsClient, &config.Spec, np)
+				err = aks.CreateOrUpdateAgentPool(ctx, &h.azureClients.credentials, h.azureClients.agentPoolsClient, &config.Spec, np)
 				if err != nil {
 					return config, fmt.Errorf("failed to update cluster [%s (id: %s)]: %v", config.Spec.ClusterName, config.Name, err)
 				}
diff --git a/pkg/aks/create.go b/pkg/aks/create.go
index 8bbfe007..13655920 100644
--- a/pkg/aks/create.go
+++ b/pkg/aks/create.go
@@ -308,7 +308,7 @@ func createManagedCluster(ctx context.Context, cred *Credentials, workplacesClie
 
 // CreateOrUpdateAgentPool creates a new pool(s) in AKS. If one already exists it updates the upstream node pool with
 // any provided updates.
-func CreateOrUpdateAgentPool(ctx context.Context, agentPoolClient services.AgentPoolsClientInterface, spec *aksv1.AKSClusterConfigSpec, np *aksv1.AKSNodePool) error {
+func CreateOrUpdateAgentPool(ctx context.Context, cred *Credentials, agentPoolClient services.AgentPoolsClientInterface, spec *aksv1.AKSClusterConfigSpec, np *aksv1.AKSNodePool) error {
 	if np.AvailabilityZones != nil && len(*np.AvailabilityZones) > 0 && !CheckAvailabilityZonesSupport(spec.ResourceLocation) {
 		return fmt.Errorf("availability zones are not supported in region %s", spec.ResourceLocation)
 	}
@@ -330,6 +330,19 @@ func CreateOrUpdateAgentPool(ctx context.Context, agentPoolClient services.Agent
 		NodeLabels:          np.NodeLabels,
 		NodeTaints:          utils.ConvertToSliceOfPointers(np.NodeTaints),
 	}
+	if hasCustomVirtualNetwork(spec) {
+		virtualNetworkResourceGroup := spec.ResourceGroup
+		if String(spec.VirtualNetworkResourceGroup) != "" {
+			virtualNetworkResourceGroup = String(spec.VirtualNetworkResourceGroup)
+		}
+		agentProfile.VnetSubnetID = to.Ptr(fmt.Sprintf(
+			"/subscriptions/%s/resourceGroups/%s/providers/Microsoft.Network/virtualNetworks/%s/subnets/%s",
+			cred.SubscriptionID,
+			virtualNetworkResourceGroup,
+			String(spec.VirtualNetwork),
+			String(spec.Subnet),
+		))
+	}
 
 	if np.MaxSurge != nil {
 		agentProfile.UpgradeSettings = &armcontainerservice.AgentPoolUpgradeSettings{
diff --git a/pkg/aks/create_test.go b/pkg/aks/create_test.go
index 8a2b787c..5c0e3eb1 100644
--- a/pkg/aks/create_test.go
+++ b/pkg/aks/create_test.go
@@ -540,9 +540,10 @@ var _ = Describe("CreateOrUpdateAgentPool", func() {
 					UpgradeSettings: &armcontainerservice.AgentPoolUpgradeSettings{
 						MaxSurge: nodePoolSpec.MaxSurge,
 					},
+					VnetSubnetID: nodePoolSpec.VnetSubnetID,
 				},
 			}).Return(&runtime.Poller[armcontainerservice.AgentPoolsClientCreateOrUpdateResponse]{}, nil)
-		Expect(CreateOrUpdateAgentPool(ctx, agentPoolClientMock, clusterSpec, nodePoolSpec)).To(Succeed())
+		Expect(CreateOrUpdateAgentPool(ctx, &Credentials{}, agentPoolClientMock, clusterSpec, nodePoolSpec)).To(Succeed())
 	})
 
 	It("should fail if agentPoolClient.CreateOrUpdate returns error", func() {
@@ -550,12 +551,12 @@ var _ = Describe("CreateOrUpdateAgentPool", func() {
 			ctx, clusterSpec.ResourceGroup, clusterSpec.ClusterName, String(nodePoolSpec.Name), gomock.Any()).
 			Return(&runtime.Poller[armcontainerservice.AgentPoolsClientCreateOrUpdateResponse]{}, errors.New("test-error"))
 
-		Expect(CreateOrUpdateAgentPool(ctx, agentPoolClientMock, clusterSpec, nodePoolSpec)).ToNot(Succeed())
+		Expect(CreateOrUpdateAgentPool(ctx, &Credentials{}, agentPoolClientMock, clusterSpec, nodePoolSpec)).ToNot(Succeed())
 	})
 
 	It("should fail for region without avaibility zones", func() {
 		clusterSpec.ResourceLocation = "westus"
-		Expect(CreateOrUpdateAgentPool(ctx, agentPoolClientMock, clusterSpec, nodePoolSpec)).ToNot(Succeed())
+		Expect(CreateOrUpdateAgentPool(ctx, &Credentials{}, agentPoolClientMock, clusterSpec, nodePoolSpec)).ToNot(Succeed())
 	})
 })