DevOps Peach| Private IP | Public IP | |
|---|---|---|
| Used for | Traffic inside the VNet, peering, on-premises over VPN/ExpressRoute | Traffic with the Internet and public Azure services |
| Attached to | VM NICs, Internal Load Balancers, Application Gateway | VM NICs, Load Balancer frontends, VPN Gateway, Application Gateway, Azure Firewall |
| Allocation | Dynamic (default, next free IP in the subnet) or Static (you pick one in the subnet range) | Standard SKU: always Static |
flowchart LR I["Internet"] --> P["pip-web 203.0.113.25<br/>(Standard, Static)"] P --> N["nic-web-01"] N --> PR["private IP 10.10.1.4<br/>(snet-web)"] N --> VM["vm-web-01"] %% step I: Traffic from the internet arrives at the public IP 203.0.113.25. %% step P: pip-web is a Standard SKU public IP, so it is static and attached to the NIC, not to the VM itself. %% step N: nic-web-01 holds the IP configuration: the public IP plus a private IP from snet-web. %% step PR: Other resources in the VNet reach the VM on its private IP 10.10.1.4. %% step VM: vm-web-01 uses the NIC, so both addresses lead to the same VM.
Public IPs
- IPv4, IPv6 or both; you can request a public IP prefix (a contiguous range).
- The Basic SKU was retired (30 Sep 2025) — use Standard only: always Static, closed to inbound traffic by default (an NSG must allow it), supports availability zones.
- Static keeps the same IP when the VM is stopped/deallocated; Dynamic (only on old Basic IPs) may change.
Reaching the Internet
Since 31 March 2026, subnets in new VNets are private subnets by default: VMs no longer get "default outbound access". To reach the Internet you need a NAT Gateway, a public IP on the NIC, or Standard Load Balancer outbound rules.
Trap: IPs attach to the NIC, not directly to the VM.
| Command | Meaning |
|---|---|
az network public-ip create -g rg-devops-lab -n pip-web --sku Standard --allocation-method Static |
Create a public IP |
az network public-ip show -g rg-devops-lab -n pip-web --query ipAddress -o tsv |
Show the assigned address |
Sizing subnets
| Prefix | Total addresses | Usable in Azure |
|---|---|---|
/16 |
65,536 | 65,531 |
/24 |
256 | 251 |
/26 |
64 | 59 |
/27 |
32 | 27 |
/29 |
8 | 3 |
/29 is the smallest subnet Azure allows. Some services need their own subnet of a minimum size: a VPN or ExpressRoute GatewaySubnet should be /27 or larger, and Azure Bastion needs at least /26. Leave spare ranges in the address space for subnets you will add later; resizing a subnet that already holds resources is hard.
Planning across networks
Use a private range that does not clash with offices, partners, or other VNets you might peer with later, for example a separate /16 per environment from a central plan. Azure Virtual Network Manager includes IP address management to allocate and track ranges at scale.
More on public IPs
- A DNS name label gives a public IP a name such as
myapp.southeastasia.cloudapp.azure.com, so clients do not depend on the number. - A public IP prefix reserves a contiguous block, useful when a partner must allowlist your outbound addresses.
- Routing preference chooses whether traffic travels on Microsoft's global network or enters the public internet near the region, trading performance for cost.
NAT Gateway
A NAT Gateway attached to a subnet gives all its VMs outbound internet access through one or more static public IPs (up to 16), without exposing them inbound. It scales SNAT ports automatically, which avoids the port exhaustion seen with load balancer outbound rules under heavy traffic, and it takes priority over other outbound methods on that subnet.
IPv6 can run alongside IPv4 (dual stack) on VNets, NICs, and Standard Load Balancers when clients need it.