diff --git a/.azuredevops/modulePipelines/ms.network.virtualHubs.yml b/.azuredevops/modulePipelines/ms.network.virtualHubs.yml
new file mode 100644
index 0000000000..ba7eb4d6b1
--- /dev/null
+++ b/.azuredevops/modulePipelines/ms.network.virtualHubs.yml
@@ -0,0 +1,52 @@
+name: 'Network: Virtual Hubs'
+
+parameters:
+  - name: removeDeployment
+    displayName: Remove deployed module
+    type: boolean
+    default: true
+  - name: prerelease
+    displayName: Publish prerelease module
+    type: boolean
+    default: false
+
+trigger:
+  batch: true
+  branches:
+    include:
+      - main
+  paths:
+    include:
+      - '/.azuredevops/modulePipelines/ms.network.virtualHubs.yml'
+      - '/.azuredevops/pipelineTemplates/module.*.yml'
+      - '/arm/Microsoft.Network/virtualHubs/*'
+    exclude:
+      - '/**/*.md'
+
+variables:
+  - template: '/.azuredevops/pipelineVariables/global.variables.yml'
+  - group: 'PLATFORM_VARIABLES'
+  - name: modulePath
+    value: '/arm/Microsoft.Network/virtualHubs'
+
+stages:
+  - stage: Validation
+    displayName: Pester tests
+    jobs:
+      - template: /.azuredevops/pipelineTemplates/jobs.validateModulePester.yml
+
+  - stage: Deployment
+    displayName: Deployment tests
+    jobs:
+      - template: /.azuredevops/pipelineTemplates/jobs.validateModuleDeployment.yml
+        parameters:
+          removeDeployment: '${{ parameters.removeDeployment }}'
+          deploymentBlocks:
+            - path: $(modulePath)/.parameters/min.parameters.json
+            - path: $(modulePath)/.parameters/parameters.json
+
+  - stage: Publishing
+    displayName: Publish module
+    condition: and(succeeded(), or(eq(variables['Build.SourceBranch'], 'refs/heads/main'), eq(variables['Build.SourceBranch'], 'refs/heads/master'), eq('${{ parameters.prerelease }}', 'true')))
+    jobs:
+      - template: /.azuredevops/pipelineTemplates/jobs.publishModule.yml
diff --git a/.azuredevops/platformPipelines/platform.dependencies.yml b/.azuredevops/platformPipelines/platform.dependencies.yml
index 6a95b4e36f..755b70a2be 100644
--- a/.azuredevops/platformPipelines/platform.dependencies.yml
+++ b/.azuredevops/platformPipelines/platform.dependencies.yml
@@ -810,6 +810,9 @@ stages:
             - path: $(dependencyPath)/$(resourceType)/parameters/5.aks.parameters.json
               templateFilePath: $(templateFilePath)
               displayName: AKS Virtual Network
+            - path: $(dependencyPath)/$(resourceType)/parameters/7.virtualHubConnection.parameters.json
+              templateFilePath: $(templateFilePath)
+              displayName: Virtual Hub Connection Virtual Network
             - ${{ if eq( parameters.deploySqlMiDependencies, true) }}:
                 - path: $(dependencyPath)/$(resourceType)/parameters/6.sqlmi.parameters.json
                   templateFilePath: $(templateFilePath)
diff --git a/.github/workflows/ms.network.virtualHubs.yml b/.github/workflows/ms.network.virtualHubs.yml
new file mode 100644
index 0000000000..02229a7164
--- /dev/null
+++ b/.github/workflows/ms.network.virtualHubs.yml
@@ -0,0 +1,135 @@
+name: 'Network: Virtual Hubs'
+
+on:
+  workflow_dispatch:
+    inputs:
+      removeDeployment:
+        type: boolean
+        description: 'Remove deployed module'
+        required: false
+        default: 'true'
+      prerelease:
+        type: boolean
+        description: 'Publish prerelease module'
+        required: false
+        default: 'false'
+  push:
+    branches:
+      - main
+    paths:
+      - '.github/actions/templates/**'
+      - '.github/workflows/ms.network.virtualHubs.yml'
+      - 'arm/Microsoft.Network/virtualHubs/**'
+      - '!*/**/readme.md'
+      - 'utilities/pipelines/**'
+      - '!utilities/pipelines/dependencies/**'
+
+env:
+  modulePath: 'arm/Microsoft.Network/virtualHubs'
+  workflowPath: '.github/workflows/ms.network.virtualHubs.yml'
+  AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
+  ARM_SUBSCRIPTION_ID: '${{ secrets.ARM_SUBSCRIPTION_ID }}'
+  ARM_MGMTGROUP_ID: '${{ secrets.ARM_MGMTGROUP_ID }}'
+  ARM_TENANT_ID: '${{ secrets.ARM_TENANT_ID }}'
+  DEPLOYMENT_SP_ID: '${{ secrets.DEPLOYMENT_SP_ID }}'
+
+jobs:
+  ############################
+  #   SET INPUT PARAMETERS   #
+  ############################
+  job_set_workflow_param:
+    runs-on: ubuntu-20.04
+    name: 'Set input parameters to output variables'
+    steps:
+      - name: 'Checkout'
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: 'Set input parameters'
+        id: get-workflow-param
+        uses: ./.github/actions/templates/getWorkflowInput
+        with:
+          workflowPath: '${{ env.workflowPath}}'
+    outputs:
+      removeDeployment: ${{ steps.get-workflow-param.outputs.removeDeployment }}
+
+  ####################
+  #   Pester Tests   #
+  ####################
+  job_module_pester_validation:
+    runs-on: ubuntu-20.04
+    name: 'Pester tests'
+    steps:
+      - name: 'Checkout'
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: 'Run tests'
+        uses: ./.github/actions/templates/validateModulePester
+        with:
+          modulePath: '${{ env.modulePath }}'
+
+  ####################
+  # Deployment tests #
+  ####################
+  job_module_deploy_validation:
+    runs-on: ubuntu-20.04
+    name: 'Deployment tests'
+    needs:
+      - job_set_workflow_param
+      - job_module_pester_validation
+    strategy:
+      fail-fast: false
+      matrix:
+        parameterFilePaths: ['min.parameters.json', 'parameters.json']
+    steps:
+      - name: 'Checkout'
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: Set environment variables
+        uses: deep-mm/set-variables@v1.0
+        with:
+          variableFileName: 'global.variables'
+      - name: 'Using parameter file [${{ matrix.parameterFilePaths }}]'
+        uses: ./.github/actions/templates/validateModuleDeployment
+        with:
+          templateFilePath: '${{ env.modulePath }}/deploy.bicep'
+          parameterFilePath: '${{ env.modulePath }}/.parameters/${{ matrix.parameterFilePaths }}'
+          location: '${{ env.defaultLocation }}'
+          resourceGroupName: '${{ env.resourceGroupName }}'
+          subscriptionId: '${{ secrets.ARM_SUBSCRIPTION_ID }}'
+          managementGroupId: '${{ secrets.ARM_MGMTGROUP_ID }}'
+          removeDeployment: '${{ needs.job_set_workflow_param.outputs.removeDeployment }}'
+
+  ###############
+  #   PUBLISH   #
+  ###############
+  job_publish_module:
+    name: 'Publish module'
+    if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master' || github.event.inputs.prerelease == 'true'
+    runs-on: ubuntu-20.04
+    needs:
+      - job_set_workflow_param
+      - job_module_deploy_validation
+    steps:
+      - name: 'Checkout'
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: Set environment variables
+        uses: deep-mm/set-variables@v1.0
+        with:
+          variableFileName: 'global.variables'
+      - name: 'Publish module'
+        uses: ./.github/actions/templates/publishModule
+        with:
+          templateFilePath: '${{ env.modulePath }}/deploy.bicep'
+          templateSpecsRGName: '${{ env.templateSpecsRGName }}'
+          templateSpecsRGLocation: '${{ env.templateSpecsRGLocation }}'
+          templateSpecsDescription: '${{ env.templateSpecsDescription }}'
+          templateSpecsDoPublish: '${{ env.templateSpecsDoPublish }}'
+          bicepRegistryName: '${{ env.bicepRegistryName }}'
+          bicepRegistryRGName: '${{ env.bicepRegistryRGName }}'
+          bicepRegistryRgLocation: '${{ env.bicepRegistryRgLocation }}'
+          bicepRegistryDoPublish: '${{ env.bicepRegistryDoPublish }}'
diff --git a/.github/workflows/platform.dependencies.yml b/.github/workflows/platform.dependencies.yml
index a2ab0c162f..8cf071085f 100644
--- a/.github/workflows/platform.dependencies.yml
+++ b/.github/workflows/platform.dependencies.yml
@@ -1096,6 +1096,7 @@ jobs:
             '3.vnetpeer02.parameters.json',
             '4.azfw.parameters.json',
             '5.aks.parameters.json',
+            '7.virtualHubConnection.parameters.json',
             'parameters.json',
           ]
     steps:
diff --git a/arm/Microsoft.Network/virtualHubs/.bicep/nested_cuaId.bicep b/arm/Microsoft.Network/virtualHubs/.bicep/nested_cuaId.bicep
new file mode 100644
index 0000000000..8b13789179
--- /dev/null
+++ b/arm/Microsoft.Network/virtualHubs/.bicep/nested_cuaId.bicep
@@ -0,0 +1 @@
+
diff --git a/arm/Microsoft.Network/virtualHubs/.parameters/min.parameters.json b/arm/Microsoft.Network/virtualHubs/.parameters/min.parameters.json
new file mode 100644
index 0000000000..71673e6ca1
--- /dev/null
+++ b/arm/Microsoft.Network/virtualHubs/.parameters/min.parameters.json
@@ -0,0 +1,15 @@
+{
+    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+    "contentVersion": "1.0.0.0",
+    "parameters": {
+        "name": {
+            "value": "<<namePrefix>>-az-vhub-min-001"
+        },
+        "addressPrefix": {
+            "value": "10.0.0.0/16"
+        },
+        "virtualWanId": {
+            "value": "/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualWans/<<namePrefix>>-az-vw-x-001"
+        }
+    }
+}
diff --git a/arm/Microsoft.Network/virtualHubs/.parameters/parameters.json b/arm/Microsoft.Network/virtualHubs/.parameters/parameters.json
new file mode 100644
index 0000000000..88759eebb9
--- /dev/null
+++ b/arm/Microsoft.Network/virtualHubs/.parameters/parameters.json
@@ -0,0 +1,45 @@
+{
+    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+    "contentVersion": "1.0.0.0",
+    "parameters": {
+        "name": {
+            "value": "<<namePrefix>>-az-vhub-x-001"
+        },
+        "addressPrefix": {
+            "value": "10.1.0.0/16"
+        },
+        "virtualWanId": {
+            "value": "/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualWans/<<namePrefix>>-az-vw-x-001"
+        },
+        "hubRouteTables": {
+            "value": [
+                {
+                    "name": "routeTable1"
+                }
+            ]
+        },
+        "hubVirtualNetworkConnections": {
+            "value": [
+                {
+                    "name": "connection1",
+                    "remoteVirtualNetworkId": "/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/adp-<<namePrefix>>-az-vnet-x-vhub",
+                    "routingConfiguration": {
+                        "associatedRouteTable": {
+                            "id": "/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualHubs/<<namePrefix>>-az-vHub-x-001/hubRouteTables/routeTable1"
+                        },
+                        "propagatedRouteTables": {
+                            "ids": [
+                                {
+                                    "id": "/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualHubs/<<namePrefix>>-az-vHub-x-001/hubRouteTables/routeTable1"
+                                }
+                            ],
+                            "labels": [
+                                "none"
+                            ]
+                        }
+                    }
+                }
+            ]
+        }
+    }
+}
diff --git a/arm/Microsoft.Network/virtualHubs/deploy.bicep b/arm/Microsoft.Network/virtualHubs/deploy.bicep
new file mode 100644
index 0000000000..c7c7437961
--- /dev/null
+++ b/arm/Microsoft.Network/virtualHubs/deploy.bicep
@@ -0,0 +1,147 @@
+@description('Required. The virtual hub name.')
+param name string
+
+@description('Optional. Location for all resources.')
+param location string = resourceGroup().location
+
+@description('Optional. Tags of the resource.')
+param tags object = {}
+
+@description('Required. Address-prefix for this VirtualHub.')
+param addressPrefix string
+
+@description('Optional. Flag to control transit for VirtualRouter hub.')
+param allowBranchToBranchTraffic bool = true
+
+@description('Optional. Resource ID of the Azure Firewall to link to')
+param azureFirewallId string = ''
+
+@description('Optional. Resource ID of the Express Route Gateway to link to')
+param expressRouteGatewayId string = ''
+
+@description('Optional. Resource ID of the Point-to-Site VPN Gateway to link to')
+param p2SVpnGatewayId string = ''
+
+@description('Optional. The preferred routing gateway types')
+@allowed([
+  'ExpressRoute'
+  'None'
+  'VpnGateway'
+  ''
+])
+param preferredRoutingGateway string = ''
+
+@description('Optional. VirtualHub route tables')
+param routeTableRoutes array = []
+
+@description('Optional. ID of the Security Partner Provider to link to')
+param securityPartnerProviderId string = ''
+
+@description('Optional. The Security Provider name.')
+param securityProviderName string = ''
+
+@allowed([
+  'Basic'
+  'Standard'
+])
+@description('Optional. The sku of this VirtualHub.')
+param sku string = 'Standard'
+
+@description('Optional. List of all virtual hub route table v2s associated with this VirtualHub.')
+param virtualHubRouteTableV2s array = []
+
+@description('Optional. VirtualRouter ASN.')
+param virtualRouterAsn int = -1
+
+@description('Optional. VirtualRouter IPs.')
+param virtualRouterIps array = []
+
+@description('Required. Resource ID of the virtual WAN to link to')
+param virtualWanId string
+
+@description('Optional. Resource ID of the VPN Gateway to link to')
+param vpnGatewayId string = ''
+
+@description('Optional. Route tables to create for the virtual hub.')
+param hubRouteTables array = []
+
+@description('Optional. Virtual network connections to create for the virtual hub.')
+param hubVirtualNetworkConnections array = []
+
+@description('Optional. Customer Usage Attribution ID (GUID). This GUID must be previously registered')
+param cuaId string = ''
+
+module pid_cuaId '.bicep/nested_cuaId.bicep' = if (!empty(cuaId)) {
+  name: 'pid-${cuaId}'
+  params: {}
+}
+
+resource virtualHub 'Microsoft.Network/virtualHubs@2021-05-01' = {
+  name: name
+  location: location
+  tags: tags
+  properties: {
+    addressPrefix: addressPrefix
+    allowBranchToBranchTraffic: allowBranchToBranchTraffic
+    azureFirewall: !empty(azureFirewallId) ? {
+      id: azureFirewallId
+    } : null
+    expressRouteGateway: !empty(expressRouteGatewayId) ? {
+      id: expressRouteGatewayId
+    } : null
+    p2SVpnGateway: !empty(p2SVpnGatewayId) ? {
+      id: p2SVpnGatewayId
+    } : null
+    preferredRoutingGateway: !empty(preferredRoutingGateway) ? any(preferredRoutingGateway) : null
+    routeTable: !empty(routeTableRoutes) ? {
+      routes: routeTableRoutes
+    } : null
+    securityPartnerProvider: !empty(securityPartnerProviderId) ? {
+      id: securityPartnerProviderId
+    } : null
+    securityProviderName: securityProviderName
+    sku: sku
+    virtualHubRouteTableV2s: virtualHubRouteTableV2s
+    virtualRouterAsn: !(virtualRouterAsn == -1) ? virtualRouterAsn : null
+    virtualRouterIps: !empty(virtualRouterIps) ? virtualRouterIps : null
+    virtualWan: !empty(virtualWanId) ? {
+      id: virtualWanId
+    } : null
+    vpnGateway: !empty(vpnGatewayId) ? {
+      id: vpnGatewayId
+    } : null
+  }
+}
+
+module virtualHub_routeTables 'hubRouteTables/deploy.bicep' = [for (routeTable, index) in hubRouteTables: {
+  name: '${uniqueString(deployment().name, location)}-routeTable-${index}'
+  params: {
+    virtualHubName: virtualHub.name
+    name: routeTable.name
+    labels: contains(routeTable, 'labels') ? routeTable.labels : []
+    routes: contains(routeTable, 'routes') ? routeTable.routes : []
+  }
+}]
+
+module virtualHub_hubVirtualNetworkConnections 'hubVirtualNetworkConnections/deploy.bicep' = [for (virtualNetworkConnection, index) in hubVirtualNetworkConnections: {
+  name: '${uniqueString(deployment().name, location)}-connection-${index}'
+  params: {
+    virtualHubName: virtualHub.name
+    name: virtualNetworkConnection.name
+    enableInternetSecurity: contains(virtualNetworkConnection, 'enableInternetSecurity') ? virtualNetworkConnection.enableInternetSecurity : true
+    remoteVirtualNetworkId: virtualNetworkConnection.remoteVirtualNetworkId
+    routingConfiguration: contains(virtualNetworkConnection, 'routingConfiguration') ? virtualNetworkConnection.routingConfiguration : {}
+  }
+  dependsOn: [
+    virtualHub_routeTables
+  ]
+}]
+
+@description('The resource group the virtual hub was deployed into')
+output resourceGroupName string = resourceGroup().name
+
+@description('The resource ID of the virtual hub')
+output resourceId string = virtualHub.id
+
+@description('The name of the virtual hub')
+output name string = virtualHub.name
diff --git a/arm/Microsoft.Network/virtualHubs/hubRouteTables/.bicep/nested_cuaId.bicep b/arm/Microsoft.Network/virtualHubs/hubRouteTables/.bicep/nested_cuaId.bicep
new file mode 100644
index 0000000000..8b13789179
--- /dev/null
+++ b/arm/Microsoft.Network/virtualHubs/hubRouteTables/.bicep/nested_cuaId.bicep
@@ -0,0 +1 @@
+
diff --git a/arm/Microsoft.Network/virtualHubs/hubRouteTables/deploy.bicep b/arm/Microsoft.Network/virtualHubs/hubRouteTables/deploy.bicep
new file mode 100644
index 0000000000..321da33b5b
--- /dev/null
+++ b/arm/Microsoft.Network/virtualHubs/hubRouteTables/deploy.bicep
@@ -0,0 +1,41 @@
+@description('Required. The route table name.')
+param name string
+
+@description('Required. The virtual hub name.')
+param virtualHubName string
+
+@description('Optional. List of labels associated with this route table.')
+param labels array = []
+
+@description('Optional. List of all routes.')
+param routes array = []
+
+@description('Optional. Customer Usage Attribution ID (GUID). This GUID must be previously registered')
+param cuaId string = ''
+
+module pid_cuaId '.bicep/nested_cuaId.bicep' = if (!empty(cuaId)) {
+  name: 'pid-${cuaId}'
+  params: {}
+}
+
+resource virtualHub 'Microsoft.Network/virtualHubs@2021-05-01' existing = {
+  name: virtualHubName
+}
+
+resource hubRouteTable 'Microsoft.Network/virtualHubs/hubRouteTables@2021-05-01' = {
+  name: name
+  parent: virtualHub
+  properties: {
+    labels: !empty(labels) ? labels : null
+    routes: !empty(routes) ? routes : null
+  }
+}
+
+@description('The name of the deployed virtual hub route table')
+output name string = hubRouteTable.name
+
+@description('The resource ID of the deployed virtual hub route table')
+output resourceId string = hubRouteTable.id
+
+@description('The resource group the virtual hub route table was deployed into')
+output resourceGroupName string = resourceGroup().name
diff --git a/arm/Microsoft.Network/virtualHubs/hubRouteTables/readme.md b/arm/Microsoft.Network/virtualHubs/hubRouteTables/readme.md
new file mode 100644
index 0000000000..0305c25995
--- /dev/null
+++ b/arm/Microsoft.Network/virtualHubs/hubRouteTables/readme.md
@@ -0,0 +1,32 @@
+# Virtual Hub Route Table `[Microsoft.Network/virtualHubs/hubRouteTables]`
+
+This module deploys virtual hub route tables.
+
+
+## Resource Types
+
+| Resource Type | API Version |
+| :-- | :-- |
+| `Microsoft.Network/virtualHubs/hubRouteTables` | 2021-05-01 |
+
+## Parameters
+
+| Parameter Name | Type | Default Value | Possible Values | Description |
+| :-- | :-- | :-- | :-- | :-- |
+| `cuaId` | string |  |  | Optional. Customer Usage Attribution ID (GUID). This GUID must be previously registered |
+| `labels` | array | `[]` |  | Optional. List of labels associated with this route table. |
+| `name` | string |  |  | Required. The route table name. |
+| `routes` | array | `[]` |  | Optional. List of all routes. |
+| `virtualHubName` | string |  |  | Required. The virtual hub name. |
+
+## Outputs
+
+| Output Name | Type | Description |
+| :-- | :-- | :-- |
+| `name` | string | The name of the deployed virtual hub route table |
+| `resourceGroupName` | string | The resource group the virtual hub route table was deployed into |
+| `resourceId` | string | The resource ID of the deployed virtual hub route table |
+
+## Template references
+
+- [Virtualhubs/Hubroutetables](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Network/2021-05-01/virtualHubs/hubRouteTables)
diff --git a/arm/Microsoft.Network/virtualHubs/hubRouteTables/version.json b/arm/Microsoft.Network/virtualHubs/hubRouteTables/version.json
new file mode 100644
index 0000000000..56f8d9ca40
--- /dev/null
+++ b/arm/Microsoft.Network/virtualHubs/hubRouteTables/version.json
@@ -0,0 +1,4 @@
+{
+    "$schema": "https://raw.githubusercontent.com/dotnet/Nerdbank.GitVersioning/master/src/NerdBank.GitVersioning/version.schema.json",
+    "version": "0.4"
+}
diff --git a/arm/Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/.bicep/nested_cuaId.bicep b/arm/Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/.bicep/nested_cuaId.bicep
new file mode 100644
index 0000000000..8b13789179
--- /dev/null
+++ b/arm/Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/.bicep/nested_cuaId.bicep
@@ -0,0 +1 @@
+
diff --git a/arm/Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/deploy.bicep b/arm/Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/deploy.bicep
new file mode 100644
index 0000000000..b45de46b7e
--- /dev/null
+++ b/arm/Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/deploy.bicep
@@ -0,0 +1,47 @@
+@description('Required. The connection name.')
+param name string
+
+@description('Required. The virtual hub name.')
+param virtualHubName string
+
+@description('Optional. Enable internet security.')
+param enableInternetSecurity bool = true
+
+@description('Required. Resource ID of the virtual network to link to')
+param remoteVirtualNetworkId string
+
+@description('Optional. Routing Configuration indicating the associated and propagated route tables for this connection.')
+param routingConfiguration object = {}
+
+@description('Optional. Customer Usage Attribution ID (GUID). This GUID must be previously registered')
+param cuaId string = ''
+
+module pid_cuaId '.bicep/nested_cuaId.bicep' = if (!empty(cuaId)) {
+  name: 'pid-${cuaId}'
+  params: {}
+}
+
+resource virtualHub 'Microsoft.Network/virtualHubs@2021-05-01' existing = {
+  name: virtualHubName
+}
+
+resource hubVirtualNetworkConnection 'Microsoft.Network/virtualHubs/hubVirtualNetworkConnections@2021-05-01' = {
+  name: name
+  parent: virtualHub
+  properties: {
+    enableInternetSecurity: enableInternetSecurity
+    remoteVirtualNetwork: {
+      id: remoteVirtualNetworkId
+    }
+    routingConfiguration: !empty(routingConfiguration) ? routingConfiguration : null
+  }
+}
+
+@description('The resource group the virtual hub connection was deployed into')
+output resourceGroupName string = resourceGroup().name
+
+@description('The resource ID of the virtual hub connection')
+output resourceId string = hubVirtualNetworkConnection.id
+
+@description('The name of the virtual hub connection')
+output name string = hubVirtualNetworkConnection.name
diff --git a/arm/Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/readme.md b/arm/Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/readme.md
new file mode 100644
index 0000000000..80463970d5
--- /dev/null
+++ b/arm/Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/readme.md
@@ -0,0 +1,36 @@
+# Virtual Hub Virtual Network Connections `[Microsoft.Network/virtualHubs/hubVirtualNetworkConnections]`
+
+This module deploys virtual hub virtual network connections.
+
+## Resource Types
+
+| Resource Type | API Version |
+| :-- | :-- |
+| `Microsoft.Network/virtualHubs/hubVirtualNetworkConnections` | 2021-05-01 |
+
+## Parameters
+
+| Parameter Name | Type | Default Value | Possible Values | Description |
+| :-- | :-- | :-- | :-- | :-- |
+| `cuaId` | string |  |  | Optional. Customer Usage Attribution ID (GUID). This GUID must be previously registered |
+| `enableInternetSecurity` | bool | `True` |  | Optional. Enable internet security. |
+| `name` | string |  |  | Required. The connection name. |
+| `remoteVirtualNetworkId` | string |  |  | Required. Resource ID of the virtual network to link to |
+| `routingConfiguration` | object | `{object}` |  | Optional. Routing Configuration indicating the associated and propagated route tables for this connection. |
+| `virtualHubName` | string |  |  | Required. The virtual hub name. |
+
+### Parameter Usage: `hubVirtualNetworkConnections`
+
+...
+
+## Outputs
+
+| Output Name | Type | Description |
+| :-- | :-- | :-- |
+| `name` | string | The name of the virtual hub connection |
+| `resourceGroupName` | string | The resource group the virtual hub connection was deployed into |
+| `resourceId` | string | The resource ID of the virtual hub connection |
+
+## Template references
+
+- [Virtualhubs/Hubvirtualnetworkconnections](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Network/2021-05-01/virtualHubs/hubVirtualNetworkConnections)
diff --git a/arm/Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/version.json b/arm/Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/version.json
new file mode 100644
index 0000000000..56f8d9ca40
--- /dev/null
+++ b/arm/Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/version.json
@@ -0,0 +1,4 @@
+{
+    "$schema": "https://raw.githubusercontent.com/dotnet/Nerdbank.GitVersioning/master/src/NerdBank.GitVersioning/version.schema.json",
+    "version": "0.4"
+}
diff --git a/arm/Microsoft.Network/virtualHubs/readme.md b/arm/Microsoft.Network/virtualHubs/readme.md
new file mode 100644
index 0000000000..dc649408c2
--- /dev/null
+++ b/arm/Microsoft.Network/virtualHubs/readme.md
@@ -0,0 +1,68 @@
+# Virtual Hub `[Microsoft.Network/virtualHubs]`
+
+This module deploys a virtual hub.
+
+## Resource Types
+
+| Resource Type | API Version |
+| :-- | :-- |
+| `Microsoft.Network/virtualHubs` | 2021-05-01 |
+| `Microsoft.Network/virtualHubs/hubRouteTables` | 2021-05-01 |
+| `Microsoft.Network/virtualHubs/hubVirtualNetworkConnections` | 2021-05-01 |
+
+## Parameters
+
+| Parameter Name | Type | Default Value | Possible Values | Description |
+| :-- | :-- | :-- | :-- | :-- |
+| `addressPrefix` | string |  |  | Required. Address-prefix for this VirtualHub. |
+| `allowBranchToBranchTraffic` | bool | `True` |  | Optional. Flag to control transit for VirtualRouter hub. |
+| `azureFirewallId` | string |  |  | Optional. Resource ID of the Azure Firewall to link to |
+| `cuaId` | string |  |  | Optional. Customer Usage Attribution ID (GUID). This GUID must be previously registered |
+| `expressRouteGatewayId` | string |  |  | Optional. Resource ID of the Express Route Gateway to link to |
+| `hubRouteTables` | _[hubRouteTables](hubRouteTables/readme.md)_ array | `[]` |  | Optional. Route tables to create for the virtual hub. |
+| `hubVirtualNetworkConnections` | _[hubVirtualNetworkConnections](hubVirtualNetworkConnections/readme.md)_ array | `[]` |  | Optional. Virtual network connections to create for the virtual hub. |
+| `location` | string | `[resourceGroup().location]` |  | Optional. Location for all resources. |
+| `name` | string |  |  | Required. The virtual hub name. |
+| `p2SVpnGatewayId` | string |  |  | Optional. Resource ID of the Point-to-Site VPN Gateway to link to |
+| `preferredRoutingGateway` | string |  | `[ExpressRoute, None, VpnGateway, ]` | Optional. The preferred routing gateway types |
+| `routeTableRoutes` | array | `[]` |  | Optional. VirtualHub route tables |
+| `securityPartnerProviderId` | string |  |  | Optional. ID of the Security Partner Provider to link to |
+| `securityProviderName` | string |  |  | Optional. The Security Provider name. |
+| `sku` | string | `Standard` | `Basic`,`Standard` | Optional. The sku of this VirtualHub. |
+| `tags` | object | `{object}` |  | Optional. Tags of the resource. |
+| `virtualHubRouteTableV2s` | array | `[]` |  | Optional. List of all virtual hub route table v2s associated with this VirtualHub. |
+| `virtualRouterAsn` | int | `-1` |  | Optional. VirtualRouter ASN. |
+| `virtualRouterIps` | array | `[]` |  | Optional. VirtualRouter IPs. |
+| `virtualWanId` | string |  |  | Required. Resource ID of the virtual WAN to link to |
+| `vpnGatewayId` | string |  |  | Optional. Resource ID of the VPN Gateway to link to |
+
+### Parameter Usage: `tags`
+
+Tag names and tag values can be provided as needed. A tag can be left without a value.
+
+```json
+"tags": {
+    "value": {
+        "Environment": "Non-Prod",
+        "Contact": "test.user@testcompany.com",
+        "PurchaseOrder": "1234",
+        "CostCenter": "7890",
+        "ServiceName": "DeploymentValidation",
+        "Role": "DeploymentValidation"
+    }
+}
+```
+
+## Outputs
+
+| Output Name | Type | Description |
+| :-- | :-- | :-- |
+| `name` | string | The name of the virtual hub |
+| `resourceGroupName` | string | The resource group the virtual hub was deployed into |
+| `resourceId` | string | The resource ID of the virtual hub |
+
+## Template references
+
+- [Virtualhubs](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Network/2021-05-01/virtualHubs)
+- [Virtualhubs/Hubroutetables](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Network/2021-05-01/virtualHubs/hubRouteTables)
+- [Virtualhubs/Hubvirtualnetworkconnections](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Network/2021-05-01/virtualHubs/hubVirtualNetworkConnections)
diff --git a/arm/Microsoft.Network/virtualHubs/version.json b/arm/Microsoft.Network/virtualHubs/version.json
new file mode 100644
index 0000000000..56f8d9ca40
--- /dev/null
+++ b/arm/Microsoft.Network/virtualHubs/version.json
@@ -0,0 +1,4 @@
+{
+    "$schema": "https://raw.githubusercontent.com/dotnet/Nerdbank.GitVersioning/master/src/NerdBank.GitVersioning/version.schema.json",
+    "version": "0.4"
+}
diff --git a/utilities/pipelines/dependencies/Microsoft.Network/virtualNetworks/parameters/7.virtualHubConnection.parameters.json b/utilities/pipelines/dependencies/Microsoft.Network/virtualNetworks/parameters/7.virtualHubConnection.parameters.json
new file mode 100644
index 0000000000..9ce3eaa36a
--- /dev/null
+++ b/utilities/pipelines/dependencies/Microsoft.Network/virtualNetworks/parameters/7.virtualHubConnection.parameters.json
@@ -0,0 +1,23 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "name": {
+      "value": "adp-sxx-az-vnet-x-vhub"
+    },
+    "addressPrefixes": {
+      "value": [
+        "10.7.0.0/16"
+      ]
+    },
+    "subnets": {
+      "value": [
+        {
+          "name": "default", // Hub connection subnet
+          "addressPrefix": "10.7.0.0/24",
+          "networkSecurityGroupName": "adp-sxx-az-nsg-x-001"
+        }
+      ]
+    }
+  }
+}