Unable to Dissociate Public IP from Virtual Network Gateway for Upgrade

Question

Unable to Dissociate Public IP from Virtual Network Gateway for Upgrade

Kunal T 0

Unable to dissociate Public IP from Virtual Network Gateway. The goal is to upgrade it to Standard from Basic. User's image

Ganesh Patapati 8,755 Reputation points Microsoft External Staff Moderator

2025-07-16T11:11:06.8766667+00:00
Hello Kunal T

At the moment VPN gateway doesn't support changing the public IP address after creation.

Unfortunately it is not possible to upgrade VPN Gateway IP address without changing an IP address.

Zone-redundant and zonal gateways (gateway SKUs that have AZ in the name) both rely on a Standard SKU Azure public IP resource. Azure Standard SKU public IP resources must use a static allocation method.

To change IP address from Basic type you need to change VPN gateway to another SKU, go to the Configuration page for your virtual network gateway.

Click the dropdown arrow to show the available gateway SKUs.

Select the SKU from the dropdown.

When you change to another gateway SKU, you delete the existing gateway entirely and build a new one. Creating a gateway can often take 45 minutes or more, depending on the selected gateway SKU. In comparison, when you resize a gateway SKU, there isn't much downtime because you don't have to delete and rebuild the gateway. If you have the option to resize your gateway SKU, rather than change it, you'll want to do that. However, there are rules regarding resizing:

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#resizechange

I hope this has been helpful!

Kindly let us know if this helps or you need further assistance on this issue.

1 answer

Your answer

Ganesh Patapati 8,755 Reputation points Microsoft External Staff Moderator

2025-07-16T11:11:06.8766667+00:00

Hello Kunal T

At the moment VPN gateway doesn't support changing the public IP address after creation.

Unfortunately it is not possible to upgrade VPN Gateway IP address without changing an IP address.

Zone-redundant and zonal gateways (gateway SKUs that have AZ in the name) both rely on a Standard SKU Azure public IP resource. Azure Standard SKU public IP resources must use a static allocation method.

To change IP address from Basic type you need to change VPN gateway to another SKU, go to the Configuration page for your virtual network gateway.

Click the dropdown arrow to show the available gateway SKUs.

Select the SKU from the dropdown.

When you change to another gateway SKU, you delete the existing gateway entirely and build a new one. Creating a gateway can often take 45 minutes or more, depending on the selected gateway SKU. In comparison, when you resize a gateway SKU, there isn't much downtime because you don't have to delete and rebuild the gateway. If you have the option to resize your gateway SKU, rather than change it, you'll want to do that. However, there are rules regarding resizing:

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#resizechange

I hope this has been helpful!

Kindly let us know if this helps or you need further assistance on this issue.

Answer 1

TP 131.6K Volunteer Moderator

Hi Kunal,

What SKU is your current VPN Gateway? This will help me give you more specific advice. The migration procedure that will allow you to upgrade your Public IP to Standard SKU varies depending on your VPN Gateway SKU.

1. If your VPN Gateway SKU is Basic, the migration approach for Basic SKU VPN Gateway has not been published. The current timeline is for it to be published by July 30, 2025. There is no action needed yet.

Screenshot excerpt from documentation below:

User's image

2. If your VPN SKU is not Basic, please navigate to your VPN Gateway in the portal, click Settings -- Configuration to see if you have Migrate tab. If you have Migrate tab, please follow instructions in article below:

How to migrate a Basic SKU public IP address to Standard SKU - Preview

https://learn.microsoft.com/en-us/azure/vpn-gateway/basic-public-ip-migrate-howto

If Migrate tab is not there, it means the migration functionality hasn't rolled out to the region yet. Please see article below for more detailed information on timelines:

What's new in Azure VPN Gateway?

https://learn.microsoft.com/en-us/azure/vpn-gateway/whats-new#upcoming-projected-changes

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

Ganesh Patapati 8,755 Reputation points Microsoft External Staff Moderator

2025-07-17T06:14:40.6833333+00:00

Hello Kunal T

I see TP has addressed your queries.

Just checking in to see if the information was helpful. If you have any further updates on this issue, please feel free to post back.

If these answers your query, do click the "Upvote" and click "Accept the answer" of which might be beneficial to other community members reading this thread.
Ganesh Patapati 8,755 Reputation points Microsoft External Staff Moderator

2025-07-18T07:40:22.8633333+00:00

Hello Kunal T

I see TP has addressed your queries.

Just checking in to see if the information was helpful. If you have any further updates on this issue, please feel free to post back.

If these answers your query, do click the "Upvote" and click "Accept the answer" of which might be beneficial to other community members reading this thread.
TP 131.6K Reputation points Volunteer Moderator

2025-07-24T10:53:38.5633333+00:00

@Kunal T Any update?
TP 131.6K Reputation points Volunteer Moderator

2025-08-05T16:53:44.0266667+00:00
The latest update published today states, in regards to Basic SKU VPN Gateway:

Your actual IP address will not change, and connectivity will not be interrupted.

An automated capability to remove the Basic public IP from your gateway will be available in Sept/Oct 2025

Deprecation timeline of Basic IP for all VPN Gateways is moved from Sep 2025 to end of Jan 2026

Because Microsoft is retiring Basic public IP resources, we’re updating the Basic VPN Gateway construct. You’ll see the Basic public IP reference as an attribute on your virtual network gateway.

If you have scripts, ARM templates, or monitoring solutions that reference the Basic public IP resource, update them to use the IP address property of the virtual network gateway instead.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

Share via

Unable to Dissociate Public IP from Virtual Network Gateway for Upgrade

1 answer

Your answer