Upgrading a basic public IP address to Standard SKU - Guidance

In this article, we'll discuss guidance for upgrading your Basic SKU public IPs to Standard SKU. Standard public IPs are recommended for all production instances and provide many key differences to your infrastructure.

Steps to complete the upgrade

We recommend the following approach to upgrade to Standard SKU public IP addresses.

  1. Learn about some of the key differences between Basic SKU public IP and Standard SKU public IP.
  2. Identify the Basic SKU public IP to upgrade.
  3. Determine if you would need Zone Redundancy.
    1. If you need a zone redundant public IP address, create a new Standard SKU public IP address using Portal, PowerShell, CLI, or ARM template.
    2. If you do not need a zone redundant public IP address, use the following upgrade options.
  4. Create a migration plan for planned downtime.
  5. Depending on the resource associated with your Basic SKU public IP addresses, perform the upgrade based on the following table:
Resource using Basic SKU public IP addresses Decision path
Virtual Machine or Virtual Machine Scale Sets (flex model) Disassociate IP(s) and utilize the upgrade options detailed after the table.
Load Balancer (Basic SKU) New LB SKU required. Use the upgrade scripts for virtual machines or Virtual Machine Scale Sets (without IPs per VM) to upgrade to Standard Load Balancer
VPN Gateway (Basic SKU or VpnGw1-5 SKU using Basic IPs) New VPN Gateway SKU required. Create a new Virtual Network Gateway with a Standard SKU IP.
ExpressRoute Gateway (using Basic IPs) New ExpressRoute Gateway required. Create a new ExpressRoute Gateway with a Standard SKU IP.
Application Gateway (v1 SKU) New AppGW SKU required. Use this migration script to migrate from v1 to v2.


If you have a virtual machine scale set (uniform model) with public IP configurations per instance, note these are not Public IP resources and as such cannot be upgraded; a new virtual machine scale set is required. You can use the SKU property to specify that Standard IP configurations are required for each VMSS instance as shown here.

Basic SKU vs. Standard SKU

This section lists out some key differences between these two SKUs.

"" Standard SKU public IP Basic SKU public IP
Allocation method Static. For IPv4: Dynamic or Static; For IPv6: Dynamic.
Security Secure by default model and be closed to inbound traffic when used as a frontend. Allow traffic with network security group is required (for example, on the NIC of a virtual machine with a Standard SKU public IP attached). Open by default. Network security groups are recommended but optional for restricting inbound or outbound traffic.
Availability zones Supported. Standard IPs can be non-zonal, zonal, or zone-redundant. Zone redundant IPs can only be created in regions where three availability zones are live. IPs created before zones are live won't be zone redundant. Not supported
Routing preference Supported to enable more granular control of how traffic is routed between Azure and the Internet. Not supported.
Global tier Supported via cross-region load balancers Not supported
Standard Load Balancer Support Both IPv4 and IPv6 are supported Not supported
NAT Gateway Support IPv4 is supported Not supported
Azure Firewall Support IPv4 is supported Not supported

Upgrade using Portal, PowerShell, and Azure CLI

Use the Azure portal, Azure PowerShell, or Azure CLI to help upgrade from Basic to Standard SKU.

Next steps

For guidance on upgrading Basic Load Balancer to Standard SKUs, see: