Skip to main content
Private and public IP addresses This article explains how Azure assigns and uses private and public IP addresses within virtual networks (VNets). It covers subnet planning, IP allocation methods, public IP SKUs, and how IPs map to resources such as virtual machines, load balancers, and gateways. Use this as a practical reference when designing VNet addressing, secure public exposure, or troubleshooting connectivity.

​
Private IP addresses and subnets

When you create a virtual network (VNet) you define an address space using CIDR notation, for example 192.168.0.0/16. That address space becomes the private IP pool for resources attached to the VNet. Inside the VNet you divide the address space into subnets (for example 192.168.0.0/24 for a gateway, 192.168.1.0/24 for frontend VMs, 192.168.2.0/24 for databases). Every network interface attached to a subnet receives a private IP from that subnet’s range. Private IP addresses are used for internal traffic: VM-to-VM, cross-VNet peering, and on-premises connections over VPN or ExpressRoute. There are two private IP allocation methods:
  • Static: You assign a specific private IP to a resource. The address persists across reboots and deallocations. Use static private IPs for domain controllers, DNS servers, critical internal services, and some load balancer backends.
  • Dynamic (default): Azure allocates an available IP from the subnet pool. The IP may change if the resource is deallocated and the original address is no longer available. This behavior is similar to DHCP.
When choosing between static and dynamic, prefer static for services that require a stable internal endpoint (DNS, AD, stateful services). For ephemeral workloads or autoscaling VM pools, dynamic allocation simplifies management.
Table — private IP allocation use cases
A diagram titled "Private IP Addresses" showing a virtual network (192.168.0.0/16) divided into three subnets. The subnets are GatewaySubnet (192.168.0.0/24), frontendSubnet (192.168.1.0/24), and databaseSubnet (192.168.2.0/24) with corresponding icons for gateway, VMs, and SQL servers.

​
Public IP addresses

Private IP addresses (for example 192.168.1.4) are not routable on the public Internet. To publish a service (for example a web server) you map incoming Internet traffic to a private IP using a public IP address. This mapping occurs via NAT (for instance on a virtual machine with an associated public IP), or more commonly via load balancers, NAT gateways, or application gateways. Best practices:
  • In production, avoid assigning public IPs directly to VMs. Instead front public traffic with a firewall, application gateway, or load balancer to provide inspection, TLS offload, Web Application Firewall (WAF), and centralized access control.
  • For labs and testing, assigning a public IP directly to a VM can be acceptable for SSH/RDP access, but secure those endpoints with NSGs and strong authentication.
Public IP allocation options:
  • Static public IP: The address remains fixed and will not change.
  • Dynamic public IP: The address can change (for instance, if the resource is deprovisioned and later a different address is assigned).
Public IP SKUs: Basic vs Standard
Microsoft is deprecating the Basic public IP SKU; new deployments should use Standard public IPs and you should plan migrations for existing Basic IPs according to Microsoft’s guidance.
A diagram titled "Public IP Addresses" showing a virtual network (192.168.1.0/24) where a resource with private IP 192.168.1.4 is mapped to a public IP. The public IP connects that resource to the internet and public-facing services and is noted for use with VNet and on-premises connections (VPN/ExpressRoute).

​
Create a virtual network and subnets (Azure portal and CLI)

Follow these steps in the Azure portal to create a VNet and subnets:
  1. In the Azure portal, go to Virtual Networks and click Create.
  2. Select your subscription and a resource group (for example M4), or create a new resource group.
  3. Enter a name for the virtual network and choose a region.
  4. Azure suggests an address space (for example 10.0.0.0/16). Replace it with your planned CIDR such as 192.168.0.0/16 if required.
  5. Add subnets. Some services require dedicated subnets: GatewaySubnet (VPN gateway), AzureFirewallSubnet (Azure Firewall), AzureBastionSubnet (Bastion), RouteServer (Route Server). For workloads, create subnets like workloads-fe with 192.168.1.0/24. The portal auto-suggests ranges when adding multiple subnets.
  6. Review and create the VNet.
Azure CLI examples Create a VNet and a frontend subnet using Azure CLI:
Create an additional subnet (e.g., database subnet):
Tip: If you prefer not to manually calculate CIDR ranges, use tools like ipcalc — e.g. https://ipcalc.org/ — or an IPAM solution.

​
Inspecting and managing a VM’s network configuration

After you create a VM, view its Networking blade in the portal to inspect private and public IPs and any associated NSG rules. The network interface (NIC) attached to the VM has IP configurations that show:
  • The subnet the NIC is connected to
  • The private IP allocation method (dynamic or static)
  • Any associated public IP address
From the NIC’s IP configuration panel you can:
  • Change the private IP allocation to static and set the desired IP
  • Create or associate a public IP
  • Add additional IP configurations for multiple private/public IPs (subject to VM size and OS limitations)
  • Attach additional NICs to the VM if you need separate network interfaces with their own IPs
Note: Each NIC IP configuration can be associated with one public IP. A NIC can have multiple IP configurations, which enables multiple public IP addresses on a single NIC if supported by the VM size and OS. Alternatively, attach additional NICs to the VM and associate public IPs to those NICs.
A screenshot of the Microsoft Azure portal showing the Networking page for a virtual machine named "about-rithin-vm," including its NIC public and private IP addresses. The image also displays the VM's network security group inbound rules and port settings (SSH, HTTPS, HTTP, etc.).
A Microsoft Azure portal screenshot showing the IP configurations page for a virtual machine network interface (about-rithin-vm801). The Edit IP configuration panel is open on the right, displaying subnet, private IP allocation (dynamic/static) and public IP association settings.

​
Summary

  • Private IPs are assigned from a VNet’s address space and used for internal communication. Use static private IPs for critical internal services; dynamic is suitable for ephemeral workloads.
  • Public IPs expose services to the Internet and map to private IPs via NAT, load balancers, or gateways. Route public traffic through a firewall, application gateway, or load balancer for production security and inspection.
  • Public IP SKUs (Basic vs Standard) differ in allocation options, default security posture, and zone redundancy. Basic is being deprecated — use Standard for new deployments and follow Microsoft migration guidance.
  • Manage IP allocation and public IP associations from a VM’s network interface in the Azure portal or via Azure CLI/PowerShell.

Watch Video

Practice Lab