How to upgrade VPN Gateway non-AZ SKUs to an VPN Gateway AZ SKUs.

Question

How to upgrade VPN Gateway non-AZ SKUs to an VPN Gateway AZ SKUs.

Jorge Villon, Jr 5

Greetings,

Received the following notification from Microsoft regarding my Azure VPN gateway:

You’re receiving this notification because you are associated with one or more Azure subscriptions that use Azure VPN Gateway. For reference, you can find this notification in the Azure portal under Service Health/Health advisories using tracking ID: DYN8-G00.

Connectivity Impact: If no action is taken before 30 September 2026, your gateway might continue to function, but reliability, availability, and support will not be guaranteed .

We're retiring these SKUs because they lack redundancy, have lower availability, and are potentially more expensive because they require additional failover solutions. To assist with this migration, we have lowered pricing on AZ SKUs since 1 January 2025.

I am reconfiguring the VPN gateway to a supported SKU. In the gateway configuration settings, VPNGw2AZ is available for selection in the SKU drop-down menu (not in the picture):

VPNGateway

The Gateway already has a standard IP assigned. Is the conversion process as simple as selecting the correct SKU from the drop-down menu and saving the new settings?

Thanks,

Jorge

Jorge Villon, Jr 5 Reputation points

2026-08-25T18:03:47.5566667+00:00

Hi Jose,

Thanks for your reply. I followed the recommended steps and successfully upgraded the SKU. Azure took a few seconds to implement the changes. All set.

Thanks again.

Jorge
Jose Benjamin Solis Nolasco 12,036 Reputation points Volunteer Moderator

2026-08-25T19:55:47.6266667+00:00

@Jorge Villon, Jr Excellent, If this answer helped clarify the platform capabilities and save you troubleshooting time, please consider marking it as Accepted. This helps others in the community find similar solutions.

2 answers

Your answer

Jorge Villon, Jr 5 Reputation points

2026-08-25T18:03:47.5566667+00:00

Hi Jose,

Thanks for your reply. I followed the recommended steps and successfully upgraded the SKU. Azure took a few seconds to implement the changes. All set.

Thanks again.

Jorge
Jose Benjamin Solis Nolasco 12,036 Reputation points Volunteer Moderator

2026-08-25T19:55:47.6266667+00:00

@Jorge Villon, Jr Excellent, If this answer helped clarify the platform capabilities and save you troubleshooting time, please consider marking it as Accepted. This helps others in the community find similar solutions.

Answer 1

Welcome to Microsoft Q&A.

@Jorge Villon, Jr I hope you are doing well,

Yes. If your current gateway is using a supported non-AZ SKU such as VpnGw2, already has a Standard public IP, and VpnGw2AZ appears in the SKU dropdown, you can perform the migration directly from the Azure portal.

The procedure is:

Open the Virtual network gateway in the Azure portal.

Select Configuration.

Under SKU, select VpnGw2AZ.

Select Save.

Microsoft documents this as the supported upgrade path for moving from a non-AZ SKU to its corresponding AZ SKU:

https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-upgrade

For a migration within the same SKU tier, such as:

VpnGw2 → VpnGw2AZ

Microsoft states that no downtime is expected when the gateway uses a Standard public IP address. The upgrade itself can take approximately 45 minutes.

Your existing public IP address does not need to be replaced for this migration.

One important distinction: if you were moving to a different SKU family or tier, the behavior can be different and downtime may occur. Microsoft documents those migration scenarios separately:

https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-consolidation

Since VpnGw2AZ is already available in your portal, that is a good indication that the gateway is eligible for this particular upgrade.

You can also verify the current SKU with Azure CLI:

az network vnet-gateway show \
  --name "<gateway-name>" \
  --resource-group "<resource-group>" \
  --query "sku.name"

Microsoft documentation

Upgrade a VPN Gateway SKU https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-upgrade

VPN Gateway SKU consolidation and migration https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-consolidation

Create and manage a VPN gateway using the Azure portal https://learn.microsoft.com/en-us/azure/vpn-gateway/tutorial-create-gateway-portal

Related Microsoft Q&A discussion this was a previus question answered by me with some useful links https://learn.microsoft.com/en-us/answers/questions/5984005/the-portal-generated-vpngw1-vpngw1az-upgrade-repea

Given the September 30, 2026 retirement of the non-AZ VpnGw1-5 SKUs, I would recommend completing the migration rather than waiting for the automatic migration process.

If this answer helped clarify the platform capabilities and save you troubleshooting time, please consider marking it as Accepted. This helps others in the community find similar solutions.

Answer 2

Yes. If the gateway already uses a Standard public IP and the target AZ SKU is available in the Configuration page, the supported path is to manually upgrade the gateway SKU by selecting the AZ SKU from the dropdown and saving the change.

For this scenario:

In Azure portal, open the virtual network gateway.
Go to Configuration.
In SKU, select the AZ equivalent, such as VpnGw2AZ.
Save the configuration change.

Key points:

Manual upgrade is the recommended action for gateways that are not already on an availability zone SKU.
If the current gateway uses a Standard public IP, no downtime is expected for a manual SKU upgrade.
If the SKU already ends with AZ, no migration is needed.
The portal only shows SKUs that are available for selection for that gateway.

How to verify before changing:

In the portal: virtual network gateway → Configuration → check SKU.

In PowerShell:

  (Get-AzVirtualNetworkGateway -Name "vpn-gateway" -ResourceGroupName "test-rg").Sku.Name

In Azure CLI:

  az network vnet-gateway show --name "vpn-gateway" --resource-group "test-rg" --query "sku.name"

Important exception:

This simple in-place upgrade does not apply to Basic, legacy, or some Gen2 cases that cannot be directly upgraded. Those cases follow different workflows, and Basic SKU gateways require delete-and-recreate with downtime.

Since the gateway described already has a Standard IP and VpnGw2AZ is selectable in the portal, selecting VpnGw2AZ and saving is the correct upgrade path.