September 30, 2025 is three weeks away, and a lot of Azure admins are starting to feel it. The Azure retirements September 2025 brings affect far more workloads than most people expect. The two big ones are the end of Basic public IP support and the removal of default outbound access for new virtual networks. In the tenants I review, I regularly find Basic SKU resources sitting in forgotten deployments, or default outbound access quietly keeping legacy VMs and test sandboxes online. If you haven't checked your cloud estate yet, do it now.

Basic public IPs go offline and new networks lose default outbound access

The main change is simple. Basic public IP addresses stop working after September 30, 2025. You haven't been able to create new ones for a while, and any that are left will now just go offline. I still come across tenants that used the Basic SKU by default for years, usually because nobody updated the old ARM templates or changed their manual deployment habits. On the same date, new virtual networks stop providing automatic default outbound access. If a workload needs internet egress, you have to add a NAT Gateway or Load Balancer explicitly. I've covered the background in my posts on the Basic public IP retirement and default outbound access.

Practical tip: Moving to Standard SKU public IPs and explicit NAT gateways can feel like extra work, but you end up with much better control and security. Legacy Basic IPs often get in the way once you start working toward Zero Trust and proper network segmentation.

Three weeks are enough to find and fix the affected resources

Azure Advisor is the quickest place to start. In the Azure portal, go to Advisor → Recommendations and filter for retirements. The Service Retirement workbook (Advisor → Workbooks → Service Retirement) is even more useful, because it gives you a tenant-wide view of affected resources and how critical they are to operations. Still, neither Advisor nor the workbook catches everything. Basic public IPs are often buried in old Load Balancers or classic Application Gateways. For that reason I always pair Advisor with Azure Resource Graph Explorer and a few targeted queries that pull every Basic public IP from all subscriptions.

This is the KQL query I use to list all Basic public IPs. Run it in Azure Resource Graph Explorer; you need at least Reader on the subscription:

resources
| where type == "microsoft.network/publicipaddresses"
| where sku.name == "Basic"
| project name, resourceGroup, location, properties.ipAddress, properties.publicIPAddressVersion

The result shows every Basic IP along with its location and resource group.

The migration has no one-click fix

The usual way to move from Basic to Standard public IPs is to create a new Standard SKU public IP, swap it in for the Basic one, and delete the old IP only after you've confirmed everything still works. Keep in mind that Standard SKUs come with different firewall rule defaults, support availability zones and have no Floating IP. Load Balancers need to move to the Standard SKU as well, and Microsoft provides a PowerShell script for the migration. In production, plan a maintenance window every time. IPs are frequently hardcoded in DNS, firewall rules or external integrations.

Default outbound access has no direct replacement. If VMs still need to reach the internet, you have to deploy a NAT Gateway or Load Balancer explicitly. Legacy VMs, dev/test labs and old deployment templates are hit hardest. If you don't know where default outbound access is in use, Microsoft's documentation on default outbound access describes how to detect it, and you can also look for virtual networks that have no explicit outbound component at all.

Talk to the application owners before you change anything. They are often the only people who still know which external parties rely on a particular public IP.

A simple diagram shows how both changes interact

People often ask me how Basic public IPs and default outbound access relate to each other and what actually changes after the retirement. This diagram shows the flows:

flowchart TD
    VM["VM"] --> VNet["Virtual network"]
    VNet --> BasicIP["Basic public IP"]
    VNet --> DOA["Default outbound access"]
    BasicIP -. "End of support 2025" .-> End["No access"]
    DOA -. "Old networks only" .-> End

Figure: Basic public IP and default outbound access – how the 2025 retirements affect network connectivity

I would clean up now instead of waiting for October

The Azure retirements September 2025 go beyond infrastructure. They also affect critical workloads, dev/test environments and automation. Basic public IPs tend to sit unnoticed as single points of failure until something important breaks. Starting now with Advisor, the Service Retirement workbook and a few Resource Graph queries puts you well ahead. Coordinating the migration with application owners takes time, but you can't skip it, and it's a good opportunity to modernize old deployments and finally document your network flows properly. My Azure blog category has more hands-on migration guidance, including scripts and tips from real projects. Don't wait. Clean up now and get your cloud ready for 2026.