Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
We're simplifying our VPN Gateway SKU portfolio. Due to the lack of redundancy, lower availability, and potential higher costs associated with failover solutions, we're transitioning all non availability zone (AZ) supported SKUs to AZ supported SKUs. This article helps you understand the upcoming changes for VPN Gateway virtual network gateway SKUs. This article expands on the official announcement.
- Effective November 1, 2025: Creation of new VPN gateways using VpnGw1-5 SKUs (non-AZ) will no longer be possible. This date has changed from the originally announced January 1, 2025 date.
- Migration period: From September 2025 to September 2026, all existing VPN gateways using VpnGw1-5 SKUs (non-AZ SKUs) can be manually upgraded to VpnGw1-5 SKUs (AZ).
To support this migration, we're reducing the prices on AZ SKUs. For more information about SKUs and pricing, see the FAQ section of this article.
Note
This article doesn't apply to the following legacy gateway SKUs: Standard or High Performance. For information legacy SKUs, including legacy SKU migration, see Working with VPN Gateway legacy SKUs.
Mapping old SKUs to new SKUs
The following diagram shows current SKUs and the new SKUs they'll automatically be migrated to.
FAQ
What actions do I need to take?
- We recommend that you manually upgrade non-AZ gateway SKUs to AZ gateway SKUs using the portal/PowerShell/CLI after Sep 2025. There's no downtime expected to manually upgrade non-AZ SKUs that currently use Standard public IP addresses. If you are still using Basic IP Address, please upgrade to Standard IP address.
- If your gateway currently uses Legacy Gateway SKUs, see Working with VPN Gateway legacy SKUs.
What is the timeline?
Migration experience will be available after August 2025.
Can I create new gateways using the older SKUs?
No. You can't create a new gateway using VpnGw1-5 SKUs (non-AZ SKUs) after January 2025.
How long will my existing gateway SKUs be supported?
The existing gateway SKUs are supported until they're migrated to AZ SKUs. The targeted deprecation for non-AZ SKUs is September 16, 2026. There will be no impact to existing AZ SKUs.
Will there be any pricing differences for my gateways after migration?
Yes. On January 1, 2025 you can see the new Pricing. Until that date, the pricing changes won't show on the pricing page.
When does new AZ pricing take effect?
Yes. The new pricing timeline is:
- If your existing gateway uses a VpnGw1-5 SKU, new pricing starts after your gateway is migrated.
- If your existing gateway uses a VpnGw1AZ-5AZ SKU, new pricing starts January 1, 2025.
Can I deploy VpnGw 1-5 AZ SKUs in all regions?
Yes, effective June 2025 you'll be able to deploy AZ SKUs in all regions. If a region doesn't currently support availability zones, you can still create VPN Gateway AZ SKUs, but the deployment will remain regional. When the region supports availability zones, we'll enable zone redundancy for the gateways.
Can I migrate my Gen 1 gateway to Gen 2 gateway?
- For gateways using a Basic public IP address: You'll need to migrate your gateway to use Standard public IP address when the migration tool becomes available. As part of this Basic public IP address to Standard public IP address migration, your gateway will be upgraded to Gen2 with no further action needed.
- For gateways already using a Standard public IP address: We'll migrate these gateways to Gen2 separately before September 30, 2026. This is done seamlessly during regular updates, with no downtime involved.
Will there be downtime during migrating my non-AZ gateways?
No. This migration is seamless and there's no expected downtime during migration.
Will there be any performance impact on my gateways with this migration?
Yes. AZ SKUs get the benefits of Zone redundancy for VPN gateways in Azure regions with availability zones. If the region doesn't support zone redundancy, the gateway is regional until the region it's deployed to supports zone redundancy.
Is the VPN Gateway Basic SKU retiring?
No, the VPN Gateway Basic SKU isn't retiring. You can create a VPN gateway using the Basic gateway SKU via PowerShell or CLI.
Can I create a new Basic SKU VPN gateway using a Basic SKU public IP address after March 31, 2025?
You can create a VPN gateway using a gateway Basic SKU and a Basic public IP address SKU until June 2025. After that date, you'll use a Standard SKU public IP address when you create Basic SKU VPN gateway.
When will my Standard or HighPerformance gateway be migrated?
Standard and HighPerformance gateways will be migrated to AZ gateways in CY26. For more information, see this announcement and Working with VPN Gateway legacy SKUs.
I have an existing VPN gateway using a non-Availability Zone (non-AZ) SKU (VpnGw1–VpnGw5). What changes after this rollout?
After the "block non-AZ SKU" feature flag rolls out, existing VPN gateways using non-AZ SKUs will no longer allow configuration changes. If you attempt any management or configuration operation on a non-AZ gateway, you'll receive a ValidationException. This is expected behavior after the rollout.
Why am I seeing a ValidationException error message?
Example error message: "Microsoft.WindowsAzure.Networking.Nrp.Frontend.Common.ValidationException: VpnGw1-5 non-AZ SKUs are no longer supported for VPN gateways. Only VpnGw1-5AZ SKUs can be created going forward"
The exception indicates that configuration changes on non-AZ VPN Gateway SKUs are no longer supported. To proceed, the gateway must first be migrated to an equivalent Availability Zone-enabled (AZ) SKU.
What action is required to resolve this error?
You must migrate your VPN gateway from a non-AZ SKU to the corresponding AZ SKU before making any other changes. For example:
VpnGw1 → VpnGw1AZ
VpnGw2 → VpnGw2AZ
Will migrating to an AZ SKU cause downtime?
- Same SKU family migration (for example, VpnGw1 → VpnGw1AZ) is nondisruptive and is a metadata-only change.
- Cross-family migration (for example, VpnGw1 → VpnGw3AZ) is disruptive, consistent with existing VPN Gateway resize behavior.
Do AZ SKUs automatically become zone-redundant?
AZ SKUs are AZ-capable. They become zone-redundant only in regions that support Availability Zones, as described in this section of the article.
Next steps
For more information about SKUs, see About gateway SKUs.