How to upgrade VPN Gateway non-AZ SKUs to an VPN Gateway AZ SKUs.

Jorge Villon, Jr 5 Reputation points
2026-08-25T13:12:10.5533333+00:00

Greetings,

Received the following notification from Microsoft regarding my Azure VPN gateway:

You’re receiving this notification because you are associated with one or more Azure subscriptions that use Azure VPN Gateway. For reference, you can find this notification in the Azure portal under Service Health/Health advisories using tracking ID: DYN8-G00.

Connectivity Impact: If no action is taken before 30 September 2026, your gateway might continue to function, but reliability, availability, and support will not be guaranteed . 

We're retiring these SKUs because they lack redundancy, have lower availability, and are potentially more expensive because they require additional failover solutions. To assist with this migration, we have lowered pricing on AZ SKUs since 1 January 2025. 

I am reconfiguring the VPN gateway to a supported SKU. In the gateway configuration settings, VPNGw2AZ is available for selection in the SKU drop-down menu (not in the picture):

VPNGateway

The Gateway already has a standard IP assigned. Is the conversion process as simple as selecting the correct SKU from the drop-down menu and saving the new settings?

Thanks,

Jorge

Azure VPN Gateway
Azure VPN Gateway

An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-08-25T13:12:29.4033333+00:00

    Yes. If the gateway already uses a Standard public IP and the target AZ SKU is available in the Configuration page, the supported path is to manually upgrade the gateway SKU by selecting the AZ SKU from the dropdown and saving the change.

    For this scenario:

    1. In Azure portal, open the virtual network gateway.
    2. Go to Configuration.
    3. In SKU, select the AZ equivalent, such as VpnGw2AZ.
    4. Save the configuration change.

    Key points:

    • Manual upgrade is the recommended action for gateways that are not already on an availability zone SKU.
    • If the current gateway uses a Standard public IP, no downtime is expected for a manual SKU upgrade.
    • If the SKU already ends with AZ, no migration is needed.
    • The portal only shows SKUs that are available for selection for that gateway.

    How to verify before changing:

    • In the portal: virtual network gateway → Configuration → check SKU.
    • In PowerShell: 
        (Get-AzVirtualNetworkGateway -Name "vpn-gateway" -ResourceGroupName "test-rg").Sku.Name
    • In Azure CLI: 
        az network vnet-gateway show --name "vpn-gateway" --resource-group "test-rg" --query "sku.name"

    Important exception:

    • This simple in-place upgrade does not apply to Basic, legacy, or some Gen2 cases that cannot be directly upgraded. Those cases follow different workflows, and Basic SKU gateways require delete-and-recreate with downtime.

    Since the gateway described already has a Standard IP and VpnGw2AZ is selectable in the portal, selecting VpnGw2AZ and saving is the correct upgrade path.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Jose Benjamin Solis Nolasco 12,036 Reputation points Volunteer Moderator
    2026-08-25T14:11:36.99+00:00

    Welcome to Microsoft Q&A.

    @Jorge Villon, Jr I hope you are doing well,

    Yes. If your current gateway is using a supported non-AZ SKU such as VpnGw2, already has a Standard public IP, and VpnGw2AZ appears in the SKU dropdown, you can perform the migration directly from the Azure portal.

    The procedure is:

    1. Open the Virtual network gateway in the Azure portal.

    Select Configuration.

    Under SKU, select VpnGw2AZ.

    Select Save.

    Microsoft documents this as the supported upgrade path for moving from a non-AZ SKU to its corresponding AZ SKU:

    https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-upgrade

    For a migration within the same SKU tier, such as:

    VpnGw2 → VpnGw2AZ

    Microsoft states that no downtime is expected when the gateway uses a Standard public IP address. The upgrade itself can take approximately 45 minutes.

    Your existing public IP address does not need to be replaced for this migration.

    One important distinction: if you were moving to a different SKU family or tier, the behavior can be different and downtime may occur. Microsoft documents those migration scenarios separately:

    https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-consolidation

    Since VpnGw2AZ is already available in your portal, that is a good indication that the gateway is eligible for this particular upgrade.

    You can also verify the current SKU with Azure CLI:

    az network vnet-gateway show \
  --name "<gateway-name>" \
  --resource-group "<resource-group>" \
  --query "sku.name"

    Microsoft documentation

    Upgrade a VPN Gateway SKU https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-upgrade

    VPN Gateway SKU consolidation and migration https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-consolidation

    Create and manage a VPN gateway using the Azure portal https://learn.microsoft.com/en-us/azure/vpn-gateway/tutorial-create-gateway-portal

    Given the September 30, 2026 retirement of the non-AZ VpnGw1-5 SKUs, I would recommend completing the migration rather than waiting for the automatic migration process.

    If this answer helped clarify the platform capabilities and save you troubleshooting time, please consider marking it as Accepted. This helps others in the community find similar solutions.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.