Introduction

Welcome to the lesson: Configure Public IP Addresses in Azure. So far we’ve focused on private networks and internal communication. When you need resources to be reachable from the Internet—for example, hosting a public website or exposing a customer-facing API—you must use a public IP address. Public IPs give external reachability and are a fundamental part of securely connecting Azure services to the outside world. In this lesson you’ll learn:

• What a public IP is and how it differs from a private IP
• Which public IP SKU (Basic vs Standard) to choose based on features and SLAs
• How to attach public IPs to common Azure resources
• When to use static vs dynamic assignments and IPv4 vs IPv6
• An introduction to Bring Your Own IP (BYOIP) in Azure

Understanding these topics helps you design secure, highly available network architectures that expose only the resources you intend to the Internet.

​

What is a public IP in Azure?

A public IP address is an address reachable from the Internet. In Azure, public IPs are used to give Internet access to resources such as virtual machines, load balancers, and application gateways. Public IPs are routable across the global Internet, unlike private IPs which are valid only within defined private networks (for example, within a virtual network and on-premises networks connected via VPN or ExpressRoute). Use cases:

• Hosting public websites or APIs
• Allowing management access (RDP/SSH) from the Internet (use with caution)
• Fronting workloads with Azure Load Balancer or Application Gateway
• Assigning public endpoints for services that must be globally accessible

​

Public vs Private IP — key differences

• Scope: Public IPs are globally routable; private IPs are limited to your virtual networks and on-premises networks.
• Security: Public IPs should be protected with network security groups (NSGs), Azure Firewall, and application-layer protections. Private IPs generally have less exposure to Internet threats.
• Use cases: Public for Internet-facing services; private for internal services, databases, and backend tiers.

​

Azure Public IP SKUs (Basic vs Standard)

Azure currently offers two public IP SKUs: Basic and Standard. Choose the SKU based on production requirements like SLAs, zone support, and default security behavior. Notes:

• Standard SKU gives better SLA guarantees and supports zonal placement for higher availability.
• Standard SKU’s default-deny inbound behavior is more secure but requires explicit inbound rules (NSGs, load balancer rules).
• When in doubt for production systems, prefer Standard.

​

Where you attach public IPs in Azure

Common Azure resources that can be associated with a public IP include:

​

Static vs Dynamic allocation

• Static: The IP address is reserved and remains constant. Use static allocation for DNS records, certificates, or any scenario where the IP must not change.
• Dynamic: Azure assigns an IP from the pool when the resource is created; the IP may be released and changed if the resource is deallocated and not configured to retain it. Dynamic is useful for short-lived or non-critical resources.

Recommendation: For production-facing endpoints, use static public IPs to ensure predictable addressing.

​

IPv4 vs IPv6

Azure supports both IPv4 and IPv6 public IPs. Choose based on requirements:

• IPv4: Broadest compatibility on the Internet today.
• IPv6: Use when you need a large address space or to support networks that require IPv6 endpoints. Some Azure services may require explicit configuration for IPv6 support.

​

Bring Your Own IP (BYOIP)

BYOIP lets you bring your owned public IP address ranges into Azure and advertise them from Azure infrastructure. BYOIP is useful for:

• Preserving existing IP addresses used by customers or DNS records
• Migrating workloads to Azure without changing public IPs
• Meeting regulatory or business requirements for address ownership

​

Security considerations

Exposing services to the Internet requires a defense-in-depth strategy:

• Use Network Security Groups (NSGs) to restrict inbound traffic.
• Place Internet-facing workloads behind an Azure Firewall, Application Gateway WAF, or third-party appliances.
• Disable management ports (RDP/SSH) on public IPs, or lock them down to specific source IP ranges and use Bastion for secure access.
• Monitor public endpoints with Azure Monitor and enable logging/alerts.

​

Quick links and references

• Azure Public IP address documentation
• Azure BYOIP documentation
• Azure Load Balancer overview
• Azure Application Gateway documentation

Use the guidance above to choose the right public IP SKU and attachment model for your needs, and always design public-facing services with security and availability in mind.