Your IPv4 block on Azure, provisioned and commissioned.
Azure calls its BYOIP feature a Custom IP Prefix. The idea behind it is straightforward enough: you onboard your range, Microsoft validates your ownership and authorization, and the prefix is then announced from AS8075. Where the Azure flow differs a little from the others we cover is that it comes in two distinct phases, provision first and commission second, and there is also a fair amount of registry work to be done up front before either phase can begin. We cover all of it in this guide, and we have tried to point out along the way which parts of the heavy lifting are done by Prefixx rather than by you.
Prerequisites
Azure onboards IPv4 ranges of /24 or larger that are registered to your organization and come with a clean history behind them. One thing worth being aware of early on is that you must be able to edit the block's WHOIS/RDAP record and to publish RPKI ROAs for it, because both of these are used as ownership checkpoints during Microsoft's validation, and a block you cannot fully control at the registry will stop you cold at that point. It is exactly this that Prefixx delivers: vetted, escrow-secured blocks that come with full registry control, sourced either from the marketplace or through an off-market search carried out on your behalf. And should your budget be better suited to OPEX than to a purchase, you can lease IPv4 addresses from us instead, in which case the required record updates are coordinated by us with the address holder directly.
Provision first. Commission second.
Below is the flow as we walk our own clients through it. For the exact syntax, and for the regional versus global commissioning options, it is best to keep the official Microsoft documentation open alongside this page while you work.
Secure the block
It all begins with a clean /24 or larger and a completed RIR transfer. Since the vetting, the escrow and the registry paperwork are all handled by Prefixx, this first step is, from where you sit, mostly a conversation with us about what you need.
Create the ROA
Next, an RPKI ROA is published authorizing Microsoft's AS8075 to originate your prefix. Propagation can take up to 24 hours, so we like to get this one out of the way as early as possible.
Sign the authorization
Create a self-signed X.509 certificate, publish its public key in the block's WHOIS/RDAP record, and then sign Azure's authorization message with it. A somewhat unusual mechanism, admittedly. It is, however, the way Microsoft satisfies itself that the range really is yours to bring.
Provision
Now run az network custom-ip prefix create with the authorization and signed messages. This is where the validation happens, and once it has passed, your prefix reaches the Provisioned state.
Commission
Update the prefix to the Commissioning state. The range is then advertised by Azure, regionally at first and later globally, until the state reads Commissioned. A little patience is called for at this stage, as in our experience it does not always happen quickly, and there is nothing you can do from your side to hurry it along.
Derive & attach
Finally, create public IP prefixes and public IP addresses out of your custom prefix, and attach them to your VMs, load balancers, firewalls and gateways however you see fit.
Ownership proofs are broker work.
If you look closely at Azure's validation, you will notice that it hinges on things only the address holder can produce: a clean RIR registration, a ROA for AS8075, and a certificate published in the WHOIS/RDAP record. That happens to be precisely the territory a broker lives in day to day. Prefixx has been registered with ARIN, RIPE NCC and APNIC for many years now, and it is our team that sources the block, closes the deal through escrow, and prepares or executes each of these proofs one by one. The aim, quite simply, is that provisioning validates on the very first pass instead of coming back to you after a round of corrections.
Compare the included route
One more option we should mention before you commit. On Netrouting bare metal, BYOIP is natively included in the service, meaning the ROA and the IRR objects are prepared by our team and the announcement is coordinated with Netrouting's NOC directly. There are no signed messages and no provision or commission steps left on your plate, which for some teams is reason enough to compare the two routes.
Netrouting BYOIP guide →Azure BYOIP: common questions
The good news is that Microsoft does not charge anything for onboarding or hosting a Custom IP Prefix, and addresses derived from your own range avoid the per-address charges that are applied to Microsoft-supplied public IPs. We would still suggest checking Azure's current pricing page for the specifics, as these things do change from time to time. Your real cost, then, is the block itself, purchased or leased through Prefixx, and on our side there are zero buyer fees involved.
We generally tell clients to plan for several weeks from end to end, though it does vary from one case to the next. The RIR transfer depends on which registry is involved, the ROA needs up to 24 hours to propagate, and then come Azure's provisioning and commissioning phases, each of which is asynchronous and can take anywhere from hours to days. One thing we have found helpful is to run the registry phase in parallel with your Azure preparation, and in most of the projects we have handled this way the total timeline came out shorter by a useful margin.
Yes, and this portability is one of the main reasons people choose BYOIP in the first place. You decommission and deprovision the custom IP prefix so that the announcement is withdrawn by Microsoft, you update your ROA, and you then take the very same addresses to Netrouting bare metal, to another cloud, or to your own network. There is no re-IP involved and no renumbering either; the space, and whatever reputation you have built on it, stays yours.
Bring a block Microsoft will say yes to.
Just let us know the size you need and the region you have in mind, and we will come back to you with a quote for Azure-eligible space. The ownership proofs, as described above, are handled by us as part of the deal.
Explore related services
BYOIP
Deploy your own or leased IPv4 addresses on bare metal or cloud. We prepare the LOA, ROA and route objects for you.
Learn more →Lease IPv4
Short- and long-term IPv4 rentals provisioned in as little as 24 hours with LOA, RPKI and reverse DNS support.
Learn more →Buy IPv4
Source vetted IPv4 blocks with zero buyer fees. Prefixx manages the entire transfer process across ARIN, RIPE, APNIC and LACNIC.
Learn more →Contact us to discuss your IPv4 needs today
No hidden fees, free consult. A broker replies within one business day.