Private vs Public IP Addresses in Azure

Private IP addresses

A private IP address comes from your VNet’s address space. It is only reachable from within the same VNet, from peered VNets, or from on-premises networks connected via VPN or ExpressRoute. The public internet cannot directly reach a private IP.

Every resource that lives in a subnet gets a private IP. VMs get one private IP per network interface by default, though you can add more. Other resources like internal load balancers, private endpoints, and application gateways also get private IPs from the subnet they are placed in.

Private IPs use RFC 1918 address ranges: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. As long as your VNet uses one of these ranges, Azure assigns private IPs from it automatically.

Public IP addresses

A public IP address is a globally routable address reachable from the internet. Azure manages a pool of public IPs and assigns them to your resources when you request one. You don’t own the underlying IP infrastructure — you just use an IP from Azure’s pool.

Not every resource needs a public IP. A database server should never have one. Web servers and load balancers typically do. Think of public IPs as the front door: only resources that need to be reached from outside your organization should have them.

Public IP addresses are standalone resources in Azure. You create a public IP resource, then associate it with a VM’s network interface, a load balancer, an application gateway, or a VPN gateway. If you delete the VM, the public IP resource still exists until you delete it separately.

Dynamic vs static allocation

Both private and public IPs can be allocated dynamically or statically:

Private IPs in Azure are dynamic by default, meaning Azure picks the next available IP in the subnet. Private IPs do not change when a VM restarts (unlike public IPs), but they can change if you delete and recreate a network interface. For internal DNS records pointing to VMs, use static private IPs.

Basic vs Standard SKU for public IPs

Azure offers two SKUs for public IP addresses. The Basic SKU is being retired — always use Standard for new deployments.

Standard SKU: Zone-redundant by default, supports availability zones, uses static allocation only, requires NSGs to permit traffic (closed by default). This is what you should use.

Basic SKU: No zone redundancy, open by default (insecure), supports dynamic allocation, being retired by Microsoft. Do not use for new resources.

Managing IP addresses with Azure CLI

Create a Standard SKU static public IP address:

az network public-ip create \
  --name pip-webserver-prod \
  --resource-group rg-prod-networking \
  --location eastus \
  --sku Standard \
  --allocation-method Static \
  --zone 1 2 3

The —zone 1 2 3 flag makes the IP zone-redundant across all three availability zones in the region.

List all public IPs and see which resource each is attached to:

az network public-ip list \
  --resource-group rg-prod-networking \
  --output table

Show the actual IP address assigned:

az network public-ip show \
  --name pip-webserver-prod \
  --resource-group rg-prod-networking \
  --query "ipAddress" \
  --output tsv

Create a VM with a static private IP address:

az vm create \
  --name vm-web-01 \
  --resource-group rg-prod-compute \
  --image Ubuntu2204 \
  --vnet-name vnet-prod-eastus-001 \
  --subnet snet-web \
  --private-ip-address 10.0.1.10 \
  --public-ip-address "" \
  --admin-username azureuser \
  --generate-ssh-keys

The —public-ip-address "" flag prevents Azure from creating a public IP for the VM — good practice for any VM that does not need direct internet access.

Change a private IP from dynamic to static on an existing VM:

az network nic ip-config update \
  --name ipconfig1 \
  --nic-name vm-web-01VMNic \
  --resource-group rg-prod-compute \
  --private-ip-address 10.0.1.10 \
  --private-ip-address-allocation Static

DNS labels on public IPs

You can attach a DNS label to a Standard public IP. This gives the IP a hostname like myapp.eastus.cloudapp.azure.com, which is useful for testing before you configure a custom domain.

az network public-ip update \
  --name pip-webserver-prod \
  --resource-group rg-prod-networking \
  --dns-name myapp-prod-2026

The full hostname will be myapp-prod-2026.eastus.cloudapp.azure.com. DNS labels must be unique within a region.

Public IP prefixes

A public IP prefix is a reserved range of consecutive public IPs. If you need multiple public IPs that share a predictable prefix — for firewall allowlists or compliance requirements — a prefix guarantees that all IPs come from the same range.

az network public-ip prefix create \
  --name pip-prefix-prod \
  --resource-group rg-prod-networking \
  --location eastus \
  --length 28

A /28 prefix gives you 16 consecutive public IP addresses. These can be assigned to individual Standard public IP resources created from the prefix.