VPN Gateway public IP SKU migration preparation

Question

VPN Gateway public IP SKU migration preparation

Laura Hodge 25

I’m making plans to migrate my VPN Gateway public IP SKU to standard IP based deployment, using the provided wizard. Looking at the gateway’s Migration page and the process documentation, I see that the next step for us to do is to click the “Prepare” button on the migration page, and the following step will be to migrate.

But it’s unclear when the “prepare” step should be done:

* If it may reveal additional needed manual steps, I should do it ahead of time to allow for taking care of those

* If it will put the gateway into an intermediate migration state that might affect usage, then I should not do it until the downtime scheduled with the customer, or shortly before then.

I'm looking for more information on what the effects of the “Prepare” step will be.

Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-05-27T23:31:02.7733333+00:00

Hello Laura,

Thank you for posting your query on Microsoft Q&A platform.

We are looking into your issue and will keep you posted updates.

Thanks

Answer accepted by question author

Salamat Shah 750 MVP

Use Prepare early for readiness validation, and schedule Migrate for the planned outage window.

The “Prepare” step is non-disruptive and can be run ahead of the scheduled migration window.

It performs validation and pre-checks, and prepares required resources for the Standard Public IP deployment.
It may surface prerequisites or issues that must be resolved before migration.
It does not change the gateway’s active configuration or impact traffic flow.

When to run it:

Run Prepare in advance (days before, if needed) to identify and fix any issues early.
Perform the actual “Migrate” step during a maintenance window, as that step introduces downtime. The “Prepare” step is non-disruptive and can be run ahead of the scheduled migration window.
- It performs validation and pre-checks, and prepares required resources for the Standard Public IP deployment.
- It may surface prerequisites or issues that must be resolved before migration.
- It does not change the gateway’s active configuration or impact traffic flow.
When to run it:
- Run Prepare in advance (days before, if needed) to identify and fix any issues early.
- Perform the actual “Migrate” step during a maintenance window, as that step introduces downtime.

0 comments

1 additional answer

Your answer

Bharath Y P 10,610 Reputation points Microsoft External Staff Moderator

2026-05-27T23:31:02.7733333+00:00

Hello Laura,

Thank you for posting your query on Microsoft Q&A platform.

We are looking into your issue and will keep you posted updates.

Thanks

Answer 1

Hi Laura Hodge

Welcome to Microsoft Q&A Platform.

The Prepare validates all your VPN Gateway migration prerequisites (for example, checking you have ≥3 free IPs in your gateway subnet or that you’ve resized a /28)

Provisions the new Standard SKU public IP resource behind the scenes
Surfaces any manual tasks you still need to do before you can actually migrate
Prepare: Typically up to 40 minutes, with a maximum of 1 hour, ref the link

Note: When you migrate your public IP address Basic SKU to the Standard SKU, your VPN Gateway SKU is also migrated. Non-AZ SKUs become AZ SKUs.

It does not flip your gateway over to the new IP or put it in a “half-migrated” state that knocks traffic offline. The only time you see downtime (about 5–10 minutes) is when you click Migrate. So the best practice is:

Click Prepare well ahead of your planned maintenance window
Fix anything the tool calls out (subnet size, missing IPs, etc.)
On your scheduled downtime, click Migrate to swap in the Standard SKU public IP (and if applicable, upgrade your gateway SKU to an AZ-enabled SKU)

Ref: Migrate to a Standard SKU public IP address for VPN Gateway

Pleaseand “up-vote” wherever the information provided helps you, **this can be beneficial to other community members.