Define the boundary first
A hybrid design should clearly separate the on-premises network from cloud workloads while providing only the connectivity the business needs.
Start with address planning, routing ownership, required applications and recovery requirements before selecting the connectivity method.
Keep routing predictable
Document which prefixes exist on each side, where routes are exchanged and which security controls inspect traffic. Avoid overlapping address ranges because they create unnecessary complexity later.
Security groups, network ACLs, firewalls and on-premises controls should have clearly defined responsibilities rather than overlapping without a plan.
Design for operations
A hybrid network is a living environment. Monitoring, logging, configuration backups and documented change procedures should be part of the design from the beginning.