Azure BYOIP: bring your own IPv4 addresses as a custom IP prefix

You prove the range is yours with a ROA naming Microsoft's ASN and a certificate in its WHOIS/RDAP record, then provision it and derive public IP prefixes and addresses from it.

This guide follows the unified model, for a range used in one region, through the Azure CLI. A range cannot switch to the global/regional model, a parent with regional children, without being onboarded again.

What Azure accepts

From Microsoft's documentation, on the day we checked:

• Size. A unified prefix "must be between /21 and /24". A global parent is also /21 to /24, with regional children of /22 to /26.
• Registry and name. The range "must be owned by you and registered under your name" with a regional internet registry, ARIN, the RIPE NCC and APNIC among them. Nothing on PA, PI or legacy status.
• Who originates. Microsoft, under AS8075, or AS8070 for the US Gov Cloud. Microsoft's BYOIP pages document no option for your own ASN. The CLI command in step 1, az network custom-ip prefix create, does list an --asn parameter, described only as "The ASN for CIDR advertising", so ask Microsoft before you count on it.
• Regions. One region per prefix, and five prefixes per region by default, more on request.
• Price. "There's no charge to provision or use custom IP prefixes", nor for the public IP prefixes and addresses derived from them. Traffic is billed at internet egress rates.
• Timing. About 30 minutes to provision and 3-4 hours to commission globally.
• Limits. No Internet Routing Preference, Global Tier, ExpressRoute Microsoft peering or Standard v2 public IPs. Reverse DNS runs from your own zones in Azure DNS, Windows Server Activation can take up to a week, and a provisioned range cannot change subscription.

Before you start

A ROA for AS8075, with the prefix length exactly as Microsoft will advertise it and an expiry date covering the time you want it advertised (RPKI and ROAs). Allow at least 24 hours for Microsoft to see it. Microsoft also recommends a ROA for any ASN that announces the range today.

A key pair and a self-signed certificate, made with OpenSSL:

openssl genrsa -out byoipprivate.key 2048
openssl req -new -x509 -key byoipprivate.key -days 180 | tr -d "\n" > byoippublickey.cer

The certificate in the WHOIS/RDAP record of the prefix, including the BEGIN and END markers, without spaces or line breaks:

A signed authorization message: your subscription ID, the prefix and the ROA's expiry date, in that order:

byoipauth="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx|203.0.113.0/24|20270430"
byoipauthsigned=$(echo $byoipauth | tr -d "\n" | openssl dgst -sha256 -sign byoipprivate.key -keyform PEM | openssl base64 | tr -d "\n")

Microsoft asks for no letter of authorization and no route object.

Step by step

01Provision the range, in an existing resource group. In a region with availability zones, make it zone-redundant or pin it to one zone:

az network custom-ip prefix create --name byoip-203-0-113-0-24 \
  --resource-group byoip-rg --location westeurope --cidr 203.0.113.0/24 --zone 1 2 3 \
  --authorization-message "$byoipauth" --signed-message "$byoipauthsigned"

02Wait for Provisioned. The commissionedState that az network custom-ip prefix show returns goes from Provisioning to Provisioned. An early ValidationFailed means the ROA, the certificate or the message did not check out; the FailedReason field says which.

03Derive addresses. Create a public IP prefix from the range, then Standard SKU addresses from it, and attach them to VMs or load balancers; they are not advertised yet.

az network public-ip prefix create --name pip-203-0-113-0-28 --resource-group byoip-rg \
  --location westeurope --length 28 --custom-ip-prefix-name byoip-203-0-113-0-24 --zone 1 2 3

04Commission. If the range is live elsewhere, two announcements at once "could potentially create BGP routing instability or traffic loss". Commission it inside the region first (Commission, then the region-only option, in the portal, or -NoInternetAdvertise in PowerShell), test, withdraw the old announcement, then commission it globally:

az network custom-ip prefix update --name byoip-203-0-113-0-24 --resource-group byoip-rg --state commission

The range is partly advertised while Commissioning, from the region first, then from Microsoft's network under AS8075, until it is Commissioned.

Mistakes that cost a day

• The certificate in descr. For the RIPE NCC, Microsoft says remarks, while AWS reads descr and explicitly not remarks, so a block moving between the two clouds needs its record changed.
• A date that does not match. The date in the signed message is the ROA's expiry date, as yyyymmdd; without one, Microsoft says to pick the date until which you want the range advertised.
• A ROA with the wrong length. A mismatch with the prefix you provision fails as InvalidPrefixLengthInROA.
• Leaving in the wrong order. Delete every derived public IP prefix, then decommission the range (3-4 hours) before you change or delete the ROA. Otherwise Microsoft keeps advertising a range it is no longer authorized to announce.

If you lease the block

Microsoft's rule is the obstacle: the range "must be owned by you and registered under your name". A block registered only to the lessor does not meet that as written, and Microsoft does not say whether an assignment to you inside the holder's allocation counts, so ask the holder and Microsoft before you sign. The holder then creates the ROA for AS8075 and adds your certificate to the record's remarks. Reverse DNS needs the holder too: Azure serves it only from a reverse zone you host in Azure DNS, which the holder delegates to you. No letter of authorization is needed.

Where RTM Networks fits

We lease /24s and larger from our own RIPE NCC address space, and sell blocks in the RIPE NCC, ARIN and APNIC regions. For space leased from us, we register the assignment to your organization, create the ROA for AS8075 and add your certificate to the registry record (lease IPv4). If Microsoft wants more than an assignment in your name, buying the block settles it (buy IPv4). If you do not run your own LIR, we sponsor PI and legacy space and AS numbers (sponsoring). For fewer than 256 addresses on an Azure VM, we announce a block and deliver it over WireGuard, as Azure blocks GRE, in any size down to a single address (WireGuard tunnels). Other providers: BYOIP guides.