PolicyBased Basic VPN gateway — Delete Basic Public IP Reference fails with CannotUpdatePolicyBasedGatewayProperties

Question

PolicyBased Basic VPN gateway — Delete Basic Public IP Reference fails with CannotUpdatePolicyBasedGatewayProperties

Mo 25

I have a VPN gateway that is PolicyBased, Generation1, Basic SKU, with a Basic SKU public IP reference attached. It has an active site-to-site tunnel (Connected).

Following the "Remove the Basic SKU public IP reference from a Basic SKU VPN gateway" guidance for the June 30, 2026 Basic public IP retirement, the Configuration page validates all resources as Succeeded and the Delete Basic Public IP Reference button is available. But clicking it fails at deployment with:

CannotUpdatePolicyBasedGatewayProperties — The properties of virtual network gateway ... of vpn type policy based cannot be updated.

This looks structural: PolicyBased gateways reject property updates at the resource-provider level, and removing the public IP reference is implemented as a property update — so it fails via portal, CLI, and PowerShell alike. The validation step passes but execution fails, which suggests the migration tooling doesn't account for the PolicyBased case.

The failed deployment rolled back cleanly; the gateway is healthy and the tunnel is still Connected.

Questions:

Since PolicyBased gateways reject the customer-initiated update, can this Basic public IP reference be removed from Microsoft's side?
Has the backend Basic→Standard internal public IP migration already completed for this type of gateway?
If no action is taken, is connectivity retained after June 30, 2026?

(Happy to share the specific subscription and resource IDs privately.)

Thanmayi Godithi 11,825 Reputation points Microsoft External Staff Moderator

2026-06-23T09:31:28.9066667+00:00
Hi Mo ,

Thank you for reaching out on Microsoft Q&A forum.

For Basic SKU VPN gateways that have a Basic SKU public IP reference, the Delete Basic Public IP Reference action:

does not migrate the VPN gateway SKU

does not change the VPN gateway’s public IP value

removes the association/reference between your gateway and the customer-visible Basic SKU public IP resource

relies on an internal Standard SKU public IP resource that Azure uses after the change

The FAQ also explicitly states:

There’s no functional impact to existing S2S/P2S connectivity when removing the reference.

If you don’t delete the reference by the deadline, Microsoft does not automatically clean it up, and your gateway will be left in an unsupported state (developer SKU; no SLA guarantee).

For additional troubleshooting,please share the details requested over Private message.
Mo 25 Reputation points

2026-06-26T13:02:05.8633333+00:00

Hi @Thanmayi Godithi ,

Thanks — I've sent the requested details via private message. To clarify for the thread: the issue is that the Delete Basic Public IP Reference action fails on this gateway because it's PolicyBased (CannotUpdatePolicyBasedGatewayProperties), so I'm asking whether the reference can be removed from the backend. Continuing in PM.
Grobe Kevin 0 Reputation points

2026-07-08T12:59:04.4166667+00:00

Hi @Mo ,

did you receive any feedback regarding this? I'm currently looking for the same but can't find any Microsoft documentation actually stating that policybased gateways have to be handled differently than routebased gateways.

As far as I can see it needs to be completely redeployed, which is quite annoying
Mo 25 Reputation points

2026-07-09T04:24:21.56+00:00

Hi @Grobe Kevin ,

No resolution yet on my side — I sent the requested subscription/resource IDs via PM to @Thanmayi Godithi (moderator) but haven't had a conclusive follow-up.

To your point: I don't think you're missing anything. The doc I followed step-by-step is https://learn.microsoft.com/en-us/azure/vpn-gateway/basic-sku-public-ip-remove, and it makes no mention of PolicyBased gateways needing different handling — it's written as if "Delete Basic Public IP Reference" works uniformly for every Basic SKU gateway. Same with the companion article, https://learn.microsoft.com/en-us/azure/vpn-gateway/basic-public-ip-migrate-about, which states: "If your Basic SKU VPN gateway has a Basic SKU public IP reference, you don't use the migration process. You only need to remove the Basic SKU public IP reference from your gateway." Again, no PolicyBased exception called out.

One thing that doc does confirm (useful context, even if it doesn't solve our problem): the Basic→Standard IP swap is described as already having happened internally — "Delete Basic Public IP Reference" is framed as just removing the now-stale customer-visible pointer, not as the migration itself. So per Microsoft's own docs, the backend swap should already be done for our gateways too; it's specifically the reference-removal step that's failing for PolicyBased.
Alex Burlachenko 25,285 Reputation points MVP Volunteer Moderator

2026-07-09T07:25:13.53+00:00

hi Mo & thx for sharing urs issue here at Q&A portal,

))) So ... based on what you've described, I think you've already found the key issue. The validation succeeds, but the actual operation fails with CannotUpdatePolicyBasedGatewayProperties. That suggests removing the Basic public IP reference is implemented as a gateway property update, and PolicyBased gateways simply don't allow that type of update. Since you've reproduced the same behavior via the portal, CLI, and PowerShell, this doesn't look like a client-side or tooling issue.

At this point, only Microsoft can confirm whether the backend Basic>Standard public IP migration has already been completed for PolicyBased Basic gateways. Whether these gateways require any customer action before the retirement date.

Whether the public IP reference can be removed internally, since customers can't perform the update themselves.

I'm sure its should be escalate this to the VPN Gateway product team. Include the subscription ID, gateway resource ID, deployment correlation ID, and timestamp privately. Until Microsoft confirms otherwise, I wouldn't attempt to recreate or modify a healthy, connected PolicyBased gateway just to work around this error.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

and at my blog https://ctrlaltdel.blog/

Answer accepted by question author

0 additional answers

Your answer

Thanmayi Godithi 11,825 Reputation points Microsoft External Staff Moderator

2026-06-23T09:31:28.9066667+00:00

Hi Mo ,

Thank you for reaching out on Microsoft Q&A forum.

For Basic SKU VPN gateways that have a Basic SKU public IP reference, the Delete Basic Public IP Reference action:

does not migrate the VPN gateway SKU

does not change the VPN gateway’s public IP value

removes the association/reference between your gateway and the customer-visible Basic SKU public IP resource

relies on an internal Standard SKU public IP resource that Azure uses after the change

The FAQ also explicitly states:

There’s no functional impact to existing S2S/P2S connectivity when removing the reference.

If you don’t delete the reference by the deadline, Microsoft does not automatically clean it up, and your gateway will be left in an unsupported state (developer SKU; no SLA guarantee).

For additional troubleshooting,please share the details requested over Private message.
Mo 25 Reputation points

2026-06-26T13:02:05.8633333+00:00

Hi @Thanmayi Godithi ,

Thanks — I've sent the requested details via private message. To clarify for the thread: the issue is that the Delete Basic Public IP Reference action fails on this gateway because it's PolicyBased (CannotUpdatePolicyBasedGatewayProperties), so I'm asking whether the reference can be removed from the backend. Continuing in PM.
Grobe Kevin 0 Reputation points

2026-07-08T12:59:04.4166667+00:00

Hi @Mo ,

did you receive any feedback regarding this? I'm currently looking for the same but can't find any Microsoft documentation actually stating that policybased gateways have to be handled differently than routebased gateways.

As far as I can see it needs to be completely redeployed, which is quite annoying
Mo 25 Reputation points

2026-07-09T04:24:21.56+00:00

Hi @Grobe Kevin ,

No resolution yet on my side — I sent the requested subscription/resource IDs via PM to @Thanmayi Godithi (moderator) but haven't had a conclusive follow-up.

To your point: I don't think you're missing anything. The doc I followed step-by-step is https://learn.microsoft.com/en-us/azure/vpn-gateway/basic-sku-public-ip-remove, and it makes no mention of PolicyBased gateways needing different handling — it's written as if "Delete Basic Public IP Reference" works uniformly for every Basic SKU gateway. Same with the companion article, https://learn.microsoft.com/en-us/azure/vpn-gateway/basic-public-ip-migrate-about, which states: "If your Basic SKU VPN gateway has a Basic SKU public IP reference, you don't use the migration process. You only need to remove the Basic SKU public IP reference from your gateway." Again, no PolicyBased exception called out.

One thing that doc does confirm (useful context, even if it doesn't solve our problem): the Basic→Standard IP swap is described as already having happened internally — "Delete Basic Public IP Reference" is framed as just removing the now-stale customer-visible pointer, not as the migration itself. So per Microsoft's own docs, the backend swap should already be done for our gateways too; it's specifically the reference-removal step that's failing for PolicyBased.
Alex Burlachenko 25,285 Reputation points MVP Volunteer Moderator

2026-07-09T07:25:13.53+00:00

hi Mo & thx for sharing urs issue here at Q&A portal,

))) So ... based on what you've described, I think you've already found the key issue. The validation succeeds, but the actual operation fails with CannotUpdatePolicyBasedGatewayProperties. That suggests removing the Basic public IP reference is implemented as a gateway property update, and PolicyBased gateways simply don't allow that type of update. Since you've reproduced the same behavior via the portal, CLI, and PowerShell, this doesn't look like a client-side or tooling issue.

At this point, only Microsoft can confirm whether the backend Basic>Standard public IP migration has already been completed for PolicyBased Basic gateways. Whether these gateways require any customer action before the retirement date.

Whether the public IP reference can be removed internally, since customers can't perform the update themselves.

I'm sure its should be escalate this to the VPN Gateway product team. Include the subscription ID, gateway resource ID, deployment correlation ID, and timestamp privately. Until Microsoft confirms otherwise, I wouldn't attempt to recreate or modify a healthy, connected PolicyBased gateway just to work around this error.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

and at my blog https://ctrlaltdel.blog/

Answer 1

Hello @Mo

Thank you for the update in private message.

I can confirm that the gateway is now showing a Standard public IP and that the Basic Public IP reference is no longer present. This aligns with the expected end state for the migration.

However, I do not currently have visibility into whether this change resulted from an automated platform-side migration process or a specific Microsoft backend action. Based on the current resource state, I can only confirm that the migration appears to have been completed successfully and the gateway remains healthy.

Additionally, site-to-site connectivity continues to function as expected, this would indicate that the gateway is operating normally following the change.

Please Accept the answer if it is helpful