Your options for the Azure Public IP changes in Sept 2025
Starting September 30, 2025, Microsoft Azure is ditching the default public IP addresses for virtual machines (VMs). While this is a win for security (goodbye accidental exposure!), it’s going to make things trickier for anyone relying on VMs for outbound internet access.
In this post, we’ll break down what this change means, walk you through your options to keep things running smoothly, and share a cost comparison so you can make the best choice for your setup.
Currently, Azure assigns a default public IP for outbound internet access from VMs. This simplifies workflows by enabling VMs to communicate with external services (e.g., APIs, websites) without extra configuration. However, starting September 2025:
Microsoft’s decision to remove default public IPs from Azure VMs might seem like a hassle at first, but it’s actually a big win for cloud security—and at Enforza, we’re fully behind it. This move reduces the risk of accidental exposure, helping businesses secure their environments more effectively.
Think about it: when a public IP is automatically assigned, it’s easy to overlook the security implications. A developer might spin up a VM for testing and forget to lock it down. Suddenly, that machine—and potentially your entire network—is exposed to the internet, where attackers are constantly scanning for vulnerabilities. RDP anyone?!
By requiring you to explicitly configure outbound access, Azure is encouraging more deliberate and secure setups. Sure, it means a bit more work upfront, but it forces teams to think about how they’re managing their traffic and to avoid leaving critical resources unnecessarily exposed.
We’ve seen countless examples of how default public IPs can lead to serious problems. Imagine a database spun up for a short-term project, left with an open public IP. No one remembers it’s there until an attacker finds it and gains access to sensitive customer data. Or consider SSH and RDP ports left open on a public IP—perfect targets for brute force attacks.
One of the most common scenarios we’ve come across is old VMs that no one remembers. These “zombie resources” sit there quietly racking up charges, often with public IPs exposed. They’re an easy entry point for attackers, and when they’re compromised, the fallout can be costly—both financially and reputationally.
Removing default public IPs eliminates these risks by making exposure a conscious decision, not the default.
At Enforza, we see this as a step in the right direction. It aligns with our philosophy that cloud environments should be secure by design. When businesses are required to configure internet access explicitly, it naturally reduces mistakes and forces a more thoughtful approach.
We know this can feel like extra work, but it’s worth it. Reviewing your architecture and implementing proper controls is critical for staying ahead of potential threats. And the good news is, you don’t have to navigate this alone.
You can assign a Standard SKU Public IP to each VM to enable direct internet access; this is effectively enabling what Microsoft have disabled by default.
Azure NAT Gateway is a native solution that centralizes outbound internet connectivity for VMs in a private subnet.
Azure Firewall adds security features like L3/L4 firewalling and FQDN filtering for outbound connectivity.
An all-in-one solution combining outbound connectivity, advanced security, and visibility. It provides equivalent functionality to Azure NAT Gateway plus Azure Firewall Basic SKU at a significantly lower cost.
Scenario: An Azure VNET connected to the internet that has 5,000GB of data processed; using the 80/20 rule of 80% ingress, 20% egress (Azure only charge for egress data)
For other scenarios check out the enforza Savings Calculator https://enforza.io/calculator
If you’re relying on Azure VMs for outbound traffic, it’s critical to plan for this change. Consider:
Enforza simplifies outbound connectivity while offering advanced security features like traffic inspection and URL filtering. With transparent pricing and a realistic traffic model, Enforza is a tested, reliable solution that helps you save costs without compromising on functionality.
Microsoft’s removal of default public IPs is a significant change, but it’s also an opportunity to evaluate and optimize your network strategy. Whether you choose a dedicated public IP, NAT Gateway, Azure Firewall, or Enforza, understanding the trade-offs is key to making the right decision.
Features & Comparison
Pricing