Public IP Address Prefixes

A Public IP Prefix is a reserved, contiguous block of public IPv4 or IPv6 addresses assigned to your Azure subscription. The prefix itself is an Azure resource that defines the size of the block (e.g., /28 for 16 addresses, /29 for 8 addresses). Once created, you can create individual public IP resources from the prefix, and those IPs will come from the reserved range. The prefix ensures that all IPs allocated to your resources belong to a known, contiguous range, which simplifies network security rules, DNS configurations, and compliance requirements.

Without a prefix, when you create multiple public IP addresses, they are assigned from Azure's large pool and are generally non-contiguous. This makes it difficult to predict the exact IP range for whitelisting in third-party firewalls or for setting up reverse DNS records. A Public IP Prefix solves this by giving you a dedicated block that you control. It also reduces the administrative overhead of managing individual IPs and ensures that you can plan your IP space effectively.

When you create a Public IP Prefix, Azure reserves a block of addresses from a regional pool. The prefix is tied to a specific Azure region and subscription. You can then create standard SKU public IP addresses from the prefix. Each standard SKU public IP created from the prefix consumes one address from the block. You cannot create basic SKU public IPs from a prefix; only standard SKU is supported. The prefix itself does not consume an IP address—it just defines the range. The IPs are only consumed when you create a public IP resource from the prefix.

To create a Public IP Prefix using Azure CLI:

az network public-ip prefix create \
  --resource-group MyResourceGroup \
  --name MyPrefix \
  --location eastus \
  --prefix-length 28

To create a public IP from the prefix:

az network public-ip create \
  --resource-group MyResourceGroup \
  --name MyIP \
  --public-ip-prefix MyPrefix \
  --sku Standard \
  --allocation-method Static

To list all IPs in a prefix:

az network public-ip prefix show \
  --resource-group MyResourceGroup \
  --name MyPrefix \
  --query "publicIPAddresses"

In the Azure portal, you can navigate to the Public IP Prefix resource and see a list of associated IPs under "Overview".

A SaaS company hosts multi-tenant applications in Azure. Their customers require whitelisting of the provider's public IPs in their on-premises firewalls. Without a prefix, the provider would have to communicate each new IP address to customers, causing operational overhead. By reserving a /28 prefix, the provider ensures all outbound traffic from their Azure resources (via Azure Firewall or NAT gateway) comes from a known, contiguous range. They configure the prefix with a domain name label, and customers whitelist the entire /28 range. When the provider scales and adds more instances, new IPs from the prefix are automatically within the whitelisted range. Misconfiguration: If the provider accidentally uses a basic SKU public IP (not supported with prefix), the IP will not come from the prefix, breaking the whitelist.

An e-commerce platform uses multiple public IPs for different services (web, API, CDN). They need consistent reverse DNS (PTR) records for email deliverability and compliance. By using a /28 prefix, they can set up reverse DNS for the entire prefix once, rather than per IP. They assign a domain name label to the prefix, so each IP gets a predictable FQDN (e.g., web1.myprefix.eastus.cloudapp.azure.com). They also use the prefix with Azure Load Balancer to distribute traffic across VMs. Performance: The prefix does not introduce latency; it's purely a management construct. Common pitfall: Trying to use a global prefix for regional resources — global prefixes only work with cross-region load balancers.

A government agency must ensure that all public IPs used by Azure resources are from a known, auditable block. They create a /29 prefix per region and enforce via Azure Policy that all public IPs must be created from a prefix. This ensures that no ad-hoc IPs are used. They also set up NSG rules that only allow traffic from the prefix range to their on-premises network. Misconfiguration: If an administrator creates a public IP without specifying a prefix, the policy will deny the creation. The agency also uses Azure Monitor to alert when the prefix usage exceeds 80% capacity, triggering a request for a new prefix.