Introduction
Back in 2022, Microsoft announced the retirement of the Basic IP address SKU in Azure, effective 30 September 2025. Now, nearly three years later, that date is quickly approaching – and if you haven’t yet checked whether your environment is affected, now is the time to start.
This change requires action from anyone who has deployed a Basic Public IP address, or any resource types that use it by default – such as Load Balancers, VPN Gateways, or ExpressRoutes.
The good news? Microsoft provides an official upgrade path for most of these resources. But your first step should be to identify which of your deployments are affected.
To help with this, I’ve created a simple script that exports a list of affected resources. Combine this with Microsoft’s official upgrade guidance to ensure nothing is missed – and avoid any unexpected downtime.
What will be affected
Although the retirement concerns Public IP addresses, it will impact multiple resource types – each with its own specific upgrade path.
The resource types can be seen below in the table, included the upgrade path for the specific resource type.
| Resource using Basic SKU public IP addresses | Decision path |
|---|---|
| Virtual Machine | Use scripts or manually detach and upgrade public IPs. For standalone virtual machines, you can use the upgrade script or for virtual machines in an availability set use this script. |
| Virtual Machine Scale Sets | Replace basic SKU instance public IP addresses with new standard SKU. |
| Load Balancer (Basic SKU) | New Load Balancer SKU required. Use the upgrade script Upgrade Basic Load Balancer to Standard SKU to upgrade to Standard Load Balancer. |
| VPN Gateway (using Basic IPs) | VPN Gateway migration is required. All non-AZ SKUs become AZ SKUs. Follow the VPN Gateway migration guidance to upgrade to Standard SKU public IPs. |
| ExpressRoute Gateway (using Basic IPs) | ExpressRoute Gateway migration is required. Follow the ExpressRoute Gateway migration guidance |
| Application Gateway (v1 SKU) | New AppGW SKU required. Use this migration script to migrate from v1 to v2. |
| Azure Databricks (using Basic IPs) | For ephemeral workloads, Standard SKU public IP addresses are automatically deployed as virtual machines (VMs) cycle out through regular usage attrition with new VMs. For long running workloads, we recommended manually restarting the compute resources which replaces existing Basic IPs with Standard IPs. |
Source: Upgrade guidance for Basic SKU – Microsoft Learn
How to find the affected resources
Before you can upgrade your resources, you need to find them, but the good news is that a simple script can help you with that.
The script queries the Azure Resource Explorer, for all public IP addresses, and returns the resources that are in the basic sku.
The output will contain the following info, which can be shown as a HTML file or exported to csv, and let you work with them.
| Header | Description |
|---|---|
| public_ip | The name of the Public IP resource |
| IpAddress | The IP address assigned to the resource |
| ipsku | resource type – all of these should show as Basic, since that is what we filter for |
| location | Datacenter location |
| resourceGroup | resource group of the Public IP resource |
| subscriptionId | Subscription ID of the Public IP resource |
| attachedName | The name of the resource, which the IP is assigned to. Could be a NIC or Private endpoint |
| attachedRG | The resource group, that the attached resource is located in |
| attachedType | What type of resource the Public IP is attached to |
| attachedTo | The ID of the resource that the Public IP is attached to. I left this ID here, since it will provide you with all the details, and is usefull in cases where you wish to use the output to as source for a script. |
When you run the script, it will display the number of IP addresses that was found in the terminal – this includes both Basic and Standard SKU – however, only the basic SKU ip addresses will be exported to HTML, CSV or both – depending on the flags provided.
The reason for this is to provide a failsafe – in short, if you have any ip addresses in Azure, then the script should always return some results. If it doesn’t, you most likely need to review your permissions.
The default behaviour of the script is to generate a HTML file, and show an overview of the export
If you use the default behavior, the script will open an HTML file upon completion. The file includes the following headings and layout. If the file is empty, it means no Basic SKU IP addresses were found.
If you prefer to receive the results as a .csv file, you can use the -exportpath flag, followed by the desired file path – Please note: the path needs to include the filename.
If you don’t with the HTML export, simply add the “-openbrowser” with a $false flag.
Prerequisites
You need the following Prerequisites to run the script:
- Powershell core 6 or 7
- Tenant id
- Installed Azure AZ modules – if you are unsure about the modules, please visit the blog post explaining the different Azure Powershell modules
- Reader permissions for all subscription that you wish to check.
Download link
The script can be downloaded from Github
0 Comments