2.1.3. Public IP Addresses

Public IPs provide internet-routable addresses for Azure resources. Understanding SKUs and prefixes is essential for the exam.

Public IP SKUs:

Standard is the only SKU you can choose for a new deployment. Basic public IP addresses were retired on 30 September 2025: new ones cannot be created, and any that still exist run without support or an SLA until they are migrated. Know the table below to reason about migration scenarios, not to pick between the two.

💡 First Principle: Standard is the default and the only option for anything new. The exam question is therefore never "which SKU should I choose?" but "we are moving off Basic — what changes?" The answers come straight out of the table: an address that was open by default becomes closed until an NSG allows it, a dynamic address must become static, and the load balancer it is attached to has to move to Standard in the same operation because SKUs cannot be mixed.

⚠️ Exam Trap: The same retirement applies to Basic Load Balancer (retired 30 September 2025). Do not generalise it further — Azure Bastion, Azure Firewall, VPN Gateway and Virtual WAN all have their own Basic or Standard tiers that are unaffected and still selectable.

Public IP Address Prefixes:

A prefix reserves a contiguous range of public IPs. Use cases:

• Consistent source IP for firewalls – Allowlist a single CIDR range
• Predictable outbound IPs – NAT Gateway with known IPs
• Compliance requirements – Document and audit your public IPs

BYOIP (Bring Your Own IP): You can bring your own IP ranges to Azure if you:

1. Own the IP range (can prove via RIR records)
2. Range is at least /24
3. Create a custom prefix and commission it

⚠️ Exam Trap: Public IP prefixes cannot be resized after creation. Plan size carefully—you're committing to that range.