Azure Public IP Address Configuration

Manage Public IP Address Lifecycle and Resource Association

Public IP addresses are Azure resources that provide inbound connectivity from the internet and predictable outbound internet access. These addresses can be associated with several different resources, including virtual machines, public load balancers, Azure firewalls, and application gateways. Properly managing these associations ensures that cloud services remain accessible and secure.

When creating a public IP, you must choose between the Basic and Standard SKU. The Standard SKU is the recommended choice because it supports Availability Zones and is secure by default, meaning it requires a Network Security Group (NSG) to allow traffic. The Basic SKU is open by default and is scheduled for retirement in September 2025, so upgrading to the Standard SKU ensures long-term compatibility and better reliability for production workloads.

The allocation method determines how an IP address is assigned to a resource. Static allocation ensures the IP remains the same until the resource is deleted, while Dynamic allocation means the address might change if a resource is stopped or deallocated. To manage the lifecycle, you can dissociate an IP from a Network Interface before deleting it, but once a public IP is deleted it cannot be recovered, so careful planning is required during removal.

For organizations requiring multiple addresses, a Public IP Address Prefix provides a contiguous range of reserved IP addresses, which simplifies firewall management by allowing an entire range to be whitelisted at once. Additionally, you can configure the Routing Preference to choose between the Microsoft Global Network or the Public Internet, where choosing the Internet routing option can help reduce costs by minimizing travel on Microsoft's private backbone.

Evaluate Public IP SKUs and Associated Features

Azure offers two distinct SKUs for public IPs: Basic and Standard. The Standard SKU is the recommended choice for production because it follows a secure by default model, meaning it is closed to all traffic unless explicitly allowed by a Network Security Group. In contrast, the Basic SKU is open by default and is scheduled for retirement on September 30, 2025. Students must understand that Standard IPs only support static allocation while Basic IPs support both static and dynamic methods, and the SKU must match between the IP and the associated Load Balancer.

A critical advantage of the Standard SKU is its support for Availability Zones, which enhances infrastructure resilience. These IPs can be configured as zone-redundant, meaning they are replicated across multiple zones to survive a single zone failure, or as zonal, tied to a specific availability zone. Basic SKU IPs do not support zones and are always non-zonal resources.

Routing preference allows administrators to choose how traffic travels between Azure and the internet. The Microsoft Global Network option keeps traffic on Microsoft's high-speed fiber for as long as possible, while the Internet option exits the Microsoft network quickly to use transit ISP networks. This choice directly impacts both network performance and egress costs.

For large-scale deployments, Public IP Prefixes provide a reserved range of contiguous IP addresses, ensuring that a set of IPs is dedicated to a subscription and simplifying firewall management. Only Standard SKU static IPs can be derived from these prefixes, and benefits include predictable IP ranges for security rules, reduced management overhead during scaling, and support for both IPv4 and IPv6 stacks.

Differentiate Between Static and Dynamic Public IP Addresses

Dynamic IP addresses are assigned by default in Azure. For public IP addresses, Azure assigns the address from a range unique to each Azure region, and these addresses can change when a virtual machine is stopped and then started again. For private IP addresses, Azure reserves the first four addresses in each subnet and assigns the next available unassigned address, which can change if the network interface is deleted, assigned to a different subnet, or the allocation method is changed to static.

Static IP addresses can be optionally assigned to both public and private IP configurations. For public IP addresses, Azure assigns the address from a range unique to each region, and the address remains the same until the resource is deleted or the allocation method is changed. For private IP addresses, you select and assign an address from the subnet's range, and it remains fixed unless the network interface is deleted or reassigned.

Dynamic IP addresses are suitable for scenarios where IP stability is not critical, such as development and testing environments. Static IP addresses are ideal for production environments where consistent IP addresses are necessary for DNS settings, SSL certificates, and firewall rules. The choice between dynamic and static IP addresses depends on the specific needs of your Azure environment, and understanding these allocation methods helps ensure proper configuration and management of virtual networks.