VPN Gateway public IP SKU migration preparation

Question

VPN Gateway public IP SKU migration preparation

Laura Hodge 0

I’m making plans to migrate my VPN Gateway public IP SKU to standard IP based deployment, using the provided wizard. Looking at the gateway’s Migration page and the process documentation, I see that the next step for us to do is to click the “Prepare” button on the migration page, and the following step will be to migrate.

But it’s unclear when the “prepare” step should be done:

* If it may reveal additional needed manual steps, I should do it ahead of time to allow for taking care of those

* If it will put the gateway into an intermediate migration state that might affect usage, then I should not do it until the downtime scheduled with the customer, or shortly before then.

I'm looking for more information on what the effects of the “Prepare” step will be.

Bharath Y P 9,095 Reputation points Microsoft External Staff Moderator

2026-05-27T23:31:02.7733333+00:00

Hello Laura,

Thank you for posting your query on Microsoft Q&A platform.

We are looking into your issue and will keep you posted updates.

Thanks
Vallepu Venkateswarlu 9,650 Reputation points Microsoft External Staff Moderator

2026-05-28T00:55:59.0833333+00:00
Hi Laura Hodge

Welcome to Microsoft Q&A Platform.

The Prepare validates all your VPN Gateway migration prerequisites (for example, checking you have ≥3 free IPs in your gateway subnet or that you’ve resized a /28)

Provisions the new Standard SKU public IP resource behind the scenes

Surfaces any manual tasks you still need to do before you can actually migrate

Prepare: Typically up to 40 minutes, with a maximum of 1 hour, ref the link

Note: When you migrate your public IP address Basic SKU to the Standard SKU, your VPN Gateway SKU is also migrated. Non-AZ SKUs become AZ SKUs.

It does not flip your gateway over to the new IP or put it in a “half-migrated” state that knocks traffic offline. The only time you see downtime (about 5–10 minutes) is when you click Migrate. So the best practice is:

Click Prepare well ahead of your planned maintenance window

Fix anything the tool calls out (subnet size, missing IPs, etc.)

On your scheduled downtime, click Migrate to swap in the Standard SKU public IP (and if applicable, upgrade your gateway SKU to an AZ-enabled SKU)

Ref: Migrate to a Standard SKU public IP address for VPN Gateway

Please "upvote" if the information helped you. This will help us and others in the community as well.