{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-124-complete-custom-prefix-decommissioning-before-changing-its-route-origin/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-124-complete-custom-prefix-decommissioning-before-changing-its-route-origin/", "slug": "dse-20260917-124-complete-custom-prefix-decommissioning-before-changing-its-route-origin", "url": "https://update.dsesecurity.com/updates/dse-20260917-124-complete-custom-prefix-decommissioning-before-changing-its-route-origin/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-124-complete-custom-prefix-decommissioning-before-changing-its-route-origin.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-124-complete-custom-prefix-decommissioning-before-changing-its-route-origin/" }, "title": "Complete custom-prefix decommissioning before changing its route-origin authorization", "summary": "Track advertisement removal as an asynchronous network transition.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:56+00:00", "modified_at": "2026-09-17T16:42:36+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 205, "potentially_affected": "Use this review for an approved custom-prefix retirement or migration. Identify the prefix model, linked public prefixes, current commissioning state, external advertisements and the owner who controls the ROA. Consult the model-specific prerequisites before starting removal.", "dse_recommendation": "DSE recommends a coordinated sequence with an explicit handoff between the Azure network owner and the address-registration owner.", "primary_source": { "name": "Manage a custom IP address prefix - Azure Virtual Network | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/manage-custom-ip-address-prefix", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft strongly recommends decommissioning a custom IP prefix before modifying or deleting its route-origin authorization. Its guidance warns that otherwise Microsoft may still advertise the range after authorization is removed. Decommissioning is asynchronous, and advertisement removal is gradual while the prefix remains in the Decommissioning state. Microsoft Learn.

\n

Applicability

\n

Use this review for an approved custom-prefix retirement or migration. Identify the prefix model, linked public prefixes, current commissioning state, external advertisements and the owner who controls the ROA. Consult the model-specific prerequisites before starting removal.

\n

DSE recommendation

\n

DSE recommends a coordinated sequence with an explicit handoff between the Azure network owner and the address-registration owner. Document the state evidence required before the ROA change. Keep application cutover, advertisement withdrawal and resource deletion as separately tracked actions. Preserve the migration plan and recovery decision rather than assuming that submitting decommissioning completes the withdrawal.

\n

Verification

\n

Observe the prefix’s actual state until the documented transition is complete. Correlate it with authorized route observations and the intended application cutover. Have the responsible owner confirm the ROA action occurs at the agreed point. Record timestamps and remaining advertisements, and investigate discrepancies before declaring the range retired from Azure.

\n

Official references

\n

Microsoft Learn: Manage a custom IP address prefix.

", "content_text": "Source facts\nMicrosoft strongly recommends decommissioning a custom IP prefix before modifying or deleting its route-origin authorization. Its guidance warns that otherwise Microsoft may still advertise the range after authorization is removed. Decommissioning is asynchronous, and advertisement removal is gradual while the prefix remains in the Decommissioning state. Microsoft Learn.\nApplicability\nUse this review for an approved custom-prefix retirement or migration. Identify the prefix model, linked public prefixes, current commissioning state, external advertisements and the owner who controls the ROA. Consult the model-specific prerequisites before starting removal.\nDSE recommendation\nDSE recommends a coordinated sequence with an explicit handoff between the Azure network owner and the address-registration owner. Document the state evidence required before the ROA change. Keep application cutover, advertisement withdrawal and resource deletion as separately tracked actions. Preserve the migration plan and recovery decision rather than assuming that submitting decommissioning completes the withdrawal.\nVerification\nObserve the prefix’s actual state until the documented transition is complete. Correlate it with authorized route observations and the intended application cutover. Have the responsible owner confirm the ROA action occurs at the agreed point. Record timestamps and remaining advertisements, and investigate discrepancies before declaring the range retired from Azure.\nOfficial references\nMicrosoft Learn: Manage a custom IP address prefix.", "content_markdown": "## Source facts\n\nMicrosoft strongly recommends decommissioning a custom IP prefix before modifying or deleting its route-origin authorization. Its guidance warns that otherwise Microsoft may still advertise the range after authorization is removed. Decommissioning is asynchronous, and advertisement removal is gradual while the prefix remains in the Decommissioning state. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/manage-custom-ip-address-prefix).\n\n## Applicability\n\nUse this review for an approved custom-prefix retirement or migration. Identify the prefix model, linked public prefixes, current commissioning state, external advertisements and the owner who controls the ROA. Consult the model-specific prerequisites before starting removal.\n\n## DSE recommendation\n\nDSE recommends a coordinated sequence with an explicit handoff between the Azure network owner and the address-registration owner. Document the state evidence required before the ROA change. Keep application cutover, advertisement withdrawal and resource deletion as separately tracked actions. Preserve the migration plan and recovery decision rather than assuming that submitting decommissioning completes the withdrawal.\n\n## Verification\n\nObserve the prefix’s actual state until the documented transition is complete. Correlate it with authorized route observations and the intended application cutover. Have the responsible owner confirm the ROA action occurs at the agreed point. Record timestamps and remaining advertisements, and investigate discrepancies before declaring the range retired from Azure.\n\n## Official references\n\n[Microsoft Learn: Manage a custom IP address prefix](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/manage-custom-ip-address-prefix)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-124-complete-custom-prefix-decommissioning-before-changing-its-route-origin/", "url": "https://update.dsesecurity.com/updates/dse-20260917-124-complete-custom-prefix-decommissioning-before-changing-its-route-origin/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-124-complete-custom-prefix-decommissioning-before-changing-its-route-origin/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Complete custom-prefix decommissioning before changing its route-origin authorization", "item": "https://update.dsesecurity.com/updates/dse-20260917-124-complete-custom-prefix-decommissioning-before-changing-its-route-origin/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-124-complete-custom-prefix-decommissioning-before-changing-its-route-origin/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-124-complete-custom-prefix-decommissioning-before-changing-its-route-origin/", "url": "https://update.dsesecurity.com/updates/dse-20260917-124-complete-custom-prefix-decommissioning-before-changing-its-route-origin/", "headline": "Complete custom-prefix decommissioning before changing its route-origin authorization", "description": "Track advertisement removal as an asynchronous network transition.", "abstract": "Track advertisement removal as an asynchronous network transition.", "articleBody": "Source facts\nMicrosoft strongly recommends decommissioning a custom IP prefix before modifying or deleting its route-origin authorization. Its guidance warns that otherwise Microsoft may still advertise the range after authorization is removed. Decommissioning is asynchronous, and advertisement removal is gradual while the prefix remains in the Decommissioning state. Microsoft Learn.\nApplicability\nUse this review for an approved custom-prefix retirement or migration. Identify the prefix model, linked public prefixes, current commissioning state, external advertisements and the owner who controls the ROA. Consult the model-specific prerequisites before starting removal.\nDSE recommendation\nDSE recommends a coordinated sequence with an explicit handoff between the Azure network owner and the address-registration owner. Document the state evidence required before the ROA change. Keep application cutover, advertisement withdrawal and resource deletion as separately tracked actions. Preserve the migration plan and recovery decision rather than assuming that submitting decommissioning completes the withdrawal.\nVerification\nObserve the prefix’s actual state until the documented transition is complete. Correlate it with authorized route observations and the intended application cutover. Have the responsible owner confirm the ROA action occurs at the agreed point. Record timestamps and remaining advertisements, and investigate discrepancies before declaring the range retired from Azure.\nOfficial references\nMicrosoft Learn: Manage a custom IP address prefix.", "datePublished": "2026-09-17T16:32:56+00:00", "dateModified": "2026-09-17T16:42:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-124-complete-custom-prefix-decommissioning-before-changing-its-route-origin/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-124-complete-custom-prefix-decommissioning-before-changing-its-route-origin/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Complete custom-prefix decommissioning before changing its route-origin authorization" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 205, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Manage a custom IP address prefix - Azure Virtual Network | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/manage-custom-ip-address-prefix" } } ] } }