Quartz 5

public-ip-address

Properties2
tagsnetworking, ip-address, internet
aliasespublic IP

3 min read

Azure public IP address

What it is

An Azure public IP address is an Azure resource with an address that internet systems can route to. You attach it to a supported Azure service or component—for example a public Load Balancer, Application Gateway, VPN gateway, Azure Firewall, Bastion host, or a VM network interface.

It is like the street address on the outside of a building. It tells visitors where to reach the entrance; it does not decide who may enter or which room they may use.

Why it exists

Internet-facing services need a reachable address. Keeping the IP as its own Azure resource lets a team choose its allocation method, zone behavior, DNS label, and association separately from the workload behind it.

Key ideas

  • Reachable is not permitted. A public IP creates an internet-routable path, but an NSG, guest firewall, and the service configuration still control traffic. Application identity and authorization are separate again.
  • Standard is the current choice. Basic SKU public IPs were retired on September 30, 2025. Standard public IPs use static allocation and are closed to inbound traffic by default; allow rules are still required for an intended inbound path.
  • Static means Azure reserves the assigned address while the public-IP resource exists. Azure chooses the number—you cannot choose an arbitrary address. Deleting the public-IP resource releases it, so design DNS and allowlists with that lifecycle in mind.
  • Not every service supports every combination. IPv4/IPv6, zone options, allocation behavior, and compatible IP SKU depend on the associated service. Confirm the supported combination before deployment.
  • A workload can make outbound connections without its own public IP, but the outbound address Azure uses might not be dedicated and can change. Use a deliberate outbound design when a partner must allowlist a stable address.

Northwind example

Northwind publishes its customer web site through Application Gateway with one public IP. The web VMs stay on private addresses behind it. Luis configures the gateway listener and certificate, while Maya permits only the intended traffic through the relevant network controls. The public IP is the sign on the building; Application Gateway and the controls behind it decide how requests are handled.

For administration, Maya uses Azure Bastion so the individual VM NICs do not need public IPs. For a supplier that requires IP allowlisting for outbound traffic, the team designs a stable outbound path instead of assuming every VM’s outbound address will remain the same.

Exam decision

Choose a public IP when a supported Azure resource needs internet-routable addressing. Do not choose it merely to administer a VM; Bastion can provide RDP/SSH access without a public IP on that VM. Choose the resource that should receive the internet traffic—often a gateway or load balancer, not each backend VM.

azure-bastion · load-balancer · application-gateway · nsg

Source: Azure public IP addresses

Graph View

Backlinks