In almost every Azure environment I review, Basic public IP addresses and Basic Load Balancers are still hiding somewhere, usually in legacy resource groups or behind older workloads. Basic public IP retirement is scheduled for September 30, 2025, and that turns these old defaults into a real risk. If production VMs, VPN endpoints or test apps still depend on them, act now. Waiting means forced upgrades or emergency outages later.

Basic public IP retirement starts with finding every Basic IP in your tenant

Visibility is the first problem. Basic public IPs can be attached to VMs nobody remembers, left orphaned in dev subscriptions no one uses anymore, or sitting in test environments that slipped through the last governance rounds. I always begin in Azure Resource Graph Explorer. A short query lists every Basic public IP in your environment:

resources
| where type == "microsoft.network/publicipaddresses"
| where sku.name == "Basic"

Run it in Azure Portal → Azure Resource Graph Explorer. If you'd rather click than query, Azure Advisor shows recommendations whenever it detects Basic public IPs or Basic Load Balancers. Check dev, test and shared subscriptions as well, not only the production areas everyone already knows about.

Standard closes the doors that Basic leaves open

If nothing looks broken, upgrading can feel like busywork. But most of the Basic IPs and Load Balancers I come across were deployed when "open by default" was considered acceptable, even for workloads facing the internet. These are the main differences today:

  • Standard public IPs are closed by default. No inbound traffic gets through until you allow it with a Network Security Group (NSG).
  • Standard SKUs support zone redundancy and only offer static allocation.
  • Basic SKUs are open to the Internet by default and less resilient.

So the switch to Standard is more than a compliance item. It genuinely improves security because it lowers the chance of exposing something by accident. Microsoft documents the differences between the SKUs in detail. What matters most is that secure-by-default networking is now the expectation everywhere.

Migration works in place but always costs a short outage

Basic public IPs can now be upgraded in place to Standard, which means your external IP address stays the same. Before the upgrade, though, you have to disassociate the IP from whatever it's attached to (a VM NIC or a Load Balancer, for example), so a brief outage can't be avoided. Plan a maintenance window and check all dependencies twice. Once the upgrade is done, reassociate the Standard IP where it's needed. As of today there is no zero-downtime path.

Basic Load Balancers work differently. Microsoft offers a dedicated PowerShell module, AzureBasicLoadBalancerUpgrade, that automates the move to a Standard Load Balancer, backend pools and rules included. It doesn't catch every quirk. Floating IP and certain protocol rules may need manual adjustment, so go through the configuration carefully after the migration.

Pro tip: If you have a lot of public IPs and load balancers to upgrade, run test migrations in an isolated sandbox first. You'll find hidden dependencies there instead of in production, which matters most with complex multi-tier applications.

Maintenance windows have to cover every dependent VM and service

A mistake I see regularly is that admins only think about the obvious Azure resources. VMs with a Basic public IP attached directly will lose network connectivity during the upgrade, and that can also affect VPN gateways, Bastion hosts or external connections tied to a specific IP. Write down which services rely on each public IP, coordinate the maintenance with the owners, and test connectivity before and after the upgrade. Having a rollback plan in case something fails is a good idea too.

The flowchart below shows the main steps from discovery to a finished migration:

flowchart TD
    Start["Start"] --> Find["Find Basic IPs / Load Balancers"]
    Find --> Decide["Upgrade needed?"]
    Decide -- "Yes" --> Disassociate["Disassociate resources"]
    Disassociate --> Upgrade["Perform upgrade"]
    Upgrade --> Check["Check connectivity"]
    Check --> Done["Done"]
    Decide -- "No" --> Done

Figure: Migration steps from a Basic to a Standard public IP or Load Balancer in Azure.

I recommend starting early and testing every step

Planning for Basic public IP retirement now spares you outages at the last minute and trouble with compliance. Do the discovery systematically, especially in larger tenants where shadow IT or forgotten test labs are still running on Basic SKUs. Standard SKUs give you better security, but they also ask for network design up front, so review your NSG rules and automate wherever you can. My strong advice is to run practice migrations and document each step before you touch production. Keep an eye on Azure Advisor recommendations as well, because they often turn up Basic IPs or Load Balancers you overlooked. For more background, my blog series on network modernization is kept up to date with practical guides for real Azure environments.