VPN Gateway Basic to Standard Public IP migration failing - Deployment validation failed.

Hello Colin Thornton,

Greetings! Thanks for raising this question in Q&A forum.

This is a known issue that several customers have encountered. The "Deployment validation failed" error with a Microsoft.Network/virtualNetworkGateways preflight validation failure, even when the validation page shows all resources as Succeeded, typically indicates a stale or conflicting configuration on the gateway that the template deployment is tripping over during the actual apply step, even though the pre-check passes cleanly.

Here are the diagnostic steps and resolution paths to work through.

Step 1: Check for expired or stale Point-to-Site certificates.

One of the most common root causes for this exact error pattern is an expired client root certificate in the Point-to-Site configuration. The preflight validation succeeds, but when the deployment template tries to re-apply the gateway configuration during the reference removal, it hits the expired certificate and fails. To check and fix this:

1. In the Azure portal, go to your Virtual Network Gateway.
2. Under Settings, select Point-to-site configuration.
3. In the Root certificate section, look for any expired certificates.
4. Remove any expired or stale root certificates by selecting the three-dot menu next to each one and choosing Remove.
5. Wait for the gateway update to complete (a few minutes), then retry the Delete Basic Public IP Reference operation.

Step 2: Verify no in-flight gateway operations are pending.

Sometimes a previous failed attempt leaves the gateway in a transitional state. Check the Activity Log for your VPN gateway resource to confirm there are no stuck or pending operations. If the gateway provisioning state is anything other than Succeeded, wait for it to fully settle before retrying.

To check this via PowerShell:

$gateway = Get-AzVirtualNetworkGateway -Name "<your-gateway-name>" -ResourceGroupName "<your-rg>"
$gateway.ProvisioningState

Only proceed when this returns Succeeded.

Step 3: Check your gateway subnet for available IP addresses.

The migration operation requires at least three available IP addresses in your gateway subnet. If your subnet is /28 or smaller, the deployment may fail at the template apply step. Verify your GatewaySubnet has enough free address space before retrying.

Step 4: Retry after some time.

Community reports confirm this error has been intermittent for some gateways and resolved on its own after a few days, likely due to backend platform fixes rolling out. The fact that you received two different tracking IDs suggests the backend may be returning different error conditions on each attempt. Waiting 24 to 48 hours and retrying once more is a reasonable step before escalating.

Step 5: Open an Azure Support ticket (required for your situation).

Given you have run this three times across multiple days and have two distinct tracking IDs, this is the appropriate path. The tracking IDs you already have (ecf169a4-8b8e-4895-b920-f5e8b411796d and 3e888d6b-22b3-420b-8909-346035c08050) are valuable and should be included in the ticket so the networking team can look at the backend preflight validation logs to identify the exact cause.

1. Go to Azure portal and select Help + Support.
2. Select New support request.
3. For Issue type, select Technical.
4. For Service, select Azure VPN Gateway.
5. In the description, include both tracking IDs, your gateway name, resource group, region, and the exact error text.
6. State: "Delete Basic Public IP Reference fails with preflight validation error despite all resources showing Succeeded. Requesting backend review of tracking IDs."

Important note about the deadline.

The Basic SKU public IP deprecation deadline for VPN Gateways is end of June 2026. Given how close that is, please open the support ticket immediately in parallel with the diagnostic steps above so Microsoft can assist you within the deadline window.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.