Skip to main content
So far we’ve discussed private communication between Azure resources inside virtual networks. Often you’ll need resources—such as websites, APIs, VPN endpoints, or outbound NAT egress—to be reachable from the internet. This article explains how Azure public IP addresses are used with common services, which attachment points matter, and when to choose static vs dynamic and Standard vs Basic SKUs. The slide below summarizes where each resource receives a public IP and whether dynamic or static addresses are supported. After the slide we walk through each resource and explain the practical implications and recommendations.
A slide titled "Public IP Addresses" showing a table of Azure resources (Virtual Machines, Load Balancer, VPN Gateway, Application Gateway, Azure Firewall, NAT Gateway). The table lists where each resource uses public IPs and indicates with check/cross marks whether dynamic or static addresses are supported.
Resource summary table
ResourceWhere public IP is attachedStatic supported?Dynamic supported?Recommended for production
Virtual Machine (NIC)Network Interface (NIC)Yes (Standard or Basic static)Yes (Basic dynamic)Static (Standard)
Load Balancer (public)Front-end IP configurationYes (Standard static)Yes (Basic dynamic)Static (Standard)
VPN GatewayGateway IP configurationYes (required for production)NoStatic (Standard)
Application GatewayFront-end configurationYes (v2 Standard)Historically v1 allowed dynamicStatic (v2/Standard)
Azure FirewallFirewall front-endYes (static or prefix)NoStatic
NAT GatewayNAT Gateway outboundRequires static public IP / prefixNoStatic (required)
Resource-by-resource details
  • Virtual Machines
    Attach a public IP on the VM’s network interface (NIC) if the VM must be reachable from the internet. Basic SKU public IPs can be dynamic or static; Standard SKU public IPs are always static. For production workloads and DNS-backed endpoints, use a static Standard SKU public IP so the address remains predictable.
  • Load Balancer
    Public IPs attach to the load balancer’s front-end IP configuration. Basic SKU supports dynamic or static addresses; Standard SKU provides static addresses only and offers zone resilience and improved security. For public-facing load balancers (for example, web traffic), prefer a Standard static public IP.
  • VPN Gateway
    VPN Gateway public IPs attach to the gateway’s IP configuration. Production site-to-site and point-to-site VPNs require a static public IP (use the Standard SKU). Dynamic assignment is not appropriate because an IP change breaks persistent connectivity between sites.
  • Application Gateway
    The Application Gateway uses a public IP on its front-end configuration for internet-facing deployments. Application Gateway v2 targets production scenarios and pairs with Standard SKU static IP addresses; v1 historically allowed dynamic IPs. For internet-facing Application Gateways use a static Standard SKU public IP to keep DNS records and firewall rules stable.
  • Azure Firewall
    Azure Firewall requires public IPs on its front-end configuration to support predictable outbound SNAT and inbound rules. Use static public IP addresses or assign a public IP prefix. Static IPs keep source IPs predictable for external integrations and firewall rules.
  • NAT Gateway
    NAT Gateway provides outbound internet connectivity from subnets and is used to ensure predictable outbound source IP addresses. It requires static public IPs or a public IP prefix. Do not use dynamic public IPs for NAT Gateway.
Static public IPs are recommended for production services. They provide a predictable, persistent endpoint for DNS records, firewall rules, and external integrations. Dynamic public IPs are more appropriate for short-lived or test environments because they can change during lifecycle operations.
Public IP SKU comparison There are two public IP SKUs in Azure: Standard and Basic. Choose the SKU that meets your availability, security, and production needs.
SKUStatic vs DynamicSecurity postureAvailability zonesRecommended use
StandardAlways staticSecured by default (deny unless allowed)YesNew production workloads
BasicStatic or dynamicOpen by default (less secure)NoLegacy or testing scenarios only
Standard SKU (key points)
  • Always provides a static IP.
  • Secured by default — network access is restricted unless you explicitly allow it.
  • Supports availability zones.
  • Intended for production workloads and recommended for new deployments.
Basic SKU (key points)
  • Can be configured as static or dynamic.
  • Open by default and lacks the hardened defaults of Standard SKU.
  • Does not support availability zones.
  • Best avoided for new production deployments; use only for legacy compatibility or short-term testing.
A slide titled "Choosing the Right SKU for Public IPs" that compares Standard SKU (always static, secured by default, supports NSGs and availability zones, preferred for production) with Basic SKU (can be static or dynamic, open by default, doesn't support availability zones).
The Basic public IP SKU is intended for legacy/testing scenarios and may be deprecated in the future. For new or production deployments choose the Standard SKU to ensure security, availability zone support, and long-term compatibility.
Best practices and operational tips
  • Use Standard SKU static public IPs for any service that must remain reachable or where an IP is embedded in DNS, firewall rules, or third-party allowlists.
  • Attach public IPs in the recommended place for each service: NICs for VMs, front-end configs for load balancers and application gateways, gateway configs for VPN Gateway, firewall front-ends for Azure Firewall, and NAT Gateway for subnet egress.
  • For predictable outbound IPs (SNAT) use NAT Gateway or assign static public IPs to firewall/NAT devices. Avoid relying on dynamic IPs for outbound egress in production.
  • Consider using Public IP Prefixes when you need a contiguous range of static addresses (for example, when you must advertise a block to external partners).
Summary
  • Public IPs are attached at different places depending on the Azure service: NIC (VMs), front-end configs (Load Balancer, Application Gateway), gateway IP config (VPN Gateway), firewall front-end (Azure Firewall), and NAT Gateway for outbound.
  • Static public IPs should be used for production workloads to provide stability and predictability. Dynamic public IPs are suitable for temporary or test scenarios.
  • Prefer Standard SKU public IPs for new deployments because they are secure by default and support availability zones. Phase out Basic SKU use in production.
Further reading and references A follow-up article will provide step-by-step instructions to configure and assign public IP addresses to a virtual machine so you can apply these recommendations in real deployments.

Watch Video