{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-173-use-the-documented-parent-and-child-sizes-for-azure-custom-ipv6-prefixes/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-173-use-the-documented-parent-and-child-sizes-for-azure-custom-ipv6-prefixes/", "slug": "dse-20260917-173-use-the-documented-parent-and-child-sizes-for-azure-custom-ipv6-prefixes", "url": "https://update.dsesecurity.com/updates/dse-20260917-173-use-the-documented-parent-and-child-sizes-for-azure-custom-ipv6-prefixes/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-173-use-the-documented-parent-and-child-sizes-for-azure-custom-ipv6-prefixes.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-173-use-the-documented-parent-and-child-sizes-for-azure-custom-ipv6-prefixes/" }, "title": "Use the documented parent-and-child sizes for Azure custom IPv6 prefixes", "summary": "Keep global allocation, regional allocation and usable public prefixes distinct.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:07+00:00", "modified_at": "2026-09-17T16:46:29+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 207, "potentially_affected": "Review this model before onboarding an organization-owned IPv6 range. Identify the real parent allocation, proposed regional children and derived public prefixes. Do not substitute the documentation's sample prefix or assume every address in a regional /64 is available for derivation.", "dse_recommendation": "DSE recommends an allocation register showing the hierarchy and ownership of each range.", "primary_source": { "name": "Create a custom IPv6 address prefix in Azure - Azure Virtual Network | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/create-custom-ip-address-prefix-ipv6-portal", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s custom IPv6 prefix model uses a /48 global parent and /64 regional children. Multiple children can exist in a region, and the global range is the one validated for ownership. The guide also limits public IPv6 prefixes derived from a regional child to the first 2,048 addresses of that /64. Microsoft Learn.

\n

Applicability

\n

Review this model before onboarding an organization-owned IPv6 range. Identify the real parent allocation, proposed regional children and derived public prefixes. Do not substitute the documentation’s sample prefix or assume every address in a regional /64 is available for derivation.

\n

DSE recommendation

\n

DSE recommends an allocation register showing the hierarchy and ownership of each range. Have the address-management owner validate containment and uniqueness, then reconcile planned public allocations with the documented usable subset. Record regional placement and commissioning responsibilities separately from ownership verification. Resolve allocation assumptions before provisioning resources that depend on them.

\n

Verification

\n

Compare the created parent, children and derived public prefixes with the approved register. Confirm their resource identities, ranges and intended regions. Test only the authorized allocated endpoints and retain the resulting evidence. Keep provisioning and commissioning status distinct from proof that the applications behind the addresses are ready for traffic.

\n

Official references

\n

Microsoft Learn: Create a custom IPv6 address prefix in Azure.

", "content_text": "Source facts\nMicrosoft’s custom IPv6 prefix model uses a /48 global parent and /64 regional children. Multiple children can exist in a region, and the global range is the one validated for ownership. The guide also limits public IPv6 prefixes derived from a regional child to the first 2,048 addresses of that /64. Microsoft Learn.\nApplicability\nReview this model before onboarding an organization-owned IPv6 range. Identify the real parent allocation, proposed regional children and derived public prefixes. Do not substitute the documentation’s sample prefix or assume every address in a regional /64 is available for derivation.\nDSE recommendation\nDSE recommends an allocation register showing the hierarchy and ownership of each range. Have the address-management owner validate containment and uniqueness, then reconcile planned public allocations with the documented usable subset. Record regional placement and commissioning responsibilities separately from ownership verification. Resolve allocation assumptions before provisioning resources that depend on them.\nVerification\nCompare the created parent, children and derived public prefixes with the approved register. Confirm their resource identities, ranges and intended regions. Test only the authorized allocated endpoints and retain the resulting evidence. Keep provisioning and commissioning status distinct from proof that the applications behind the addresses are ready for traffic.\nOfficial references\nMicrosoft Learn: Create a custom IPv6 address prefix in Azure.", "content_markdown": "## Source facts\n\nMicrosoft’s custom IPv6 prefix model uses a /48 global parent and /64 regional children. Multiple children can exist in a region, and the global range is the one validated for ownership. The guide also limits public IPv6 prefixes derived from a regional child to the first 2,048 addresses of that /64. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/create-custom-ip-address-prefix-ipv6-portal).\n\n## Applicability\n\nReview this model before onboarding an organization-owned IPv6 range. Identify the real parent allocation, proposed regional children and derived public prefixes. Do not substitute the documentation’s sample prefix or assume every address in a regional /64 is available for derivation.\n\n## DSE recommendation\n\nDSE recommends an allocation register showing the hierarchy and ownership of each range. Have the address-management owner validate containment and uniqueness, then reconcile planned public allocations with the documented usable subset. Record regional placement and commissioning responsibilities separately from ownership verification. Resolve allocation assumptions before provisioning resources that depend on them.\n\n## Verification\n\nCompare the created parent, children and derived public prefixes with the approved register. Confirm their resource identities, ranges and intended regions. Test only the authorized allocated endpoints and retain the resulting evidence. Keep provisioning and commissioning status distinct from proof that the applications behind the addresses are ready for traffic.\n\n## Official references\n\n[Microsoft Learn: Create a custom IPv6 address prefix in Azure](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/create-custom-ip-address-prefix-ipv6-portal)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-173-use-the-documented-parent-and-child-sizes-for-azure-custom-ipv6-prefixes/", "url": "https://update.dsesecurity.com/updates/dse-20260917-173-use-the-documented-parent-and-child-sizes-for-azure-custom-ipv6-prefixes/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-173-use-the-documented-parent-and-child-sizes-for-azure-custom-ipv6-prefixes/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Use the documented parent-and-child sizes for Azure custom IPv6 prefixes", "item": "https://update.dsesecurity.com/updates/dse-20260917-173-use-the-documented-parent-and-child-sizes-for-azure-custom-ipv6-prefixes/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-173-use-the-documented-parent-and-child-sizes-for-azure-custom-ipv6-prefixes/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-173-use-the-documented-parent-and-child-sizes-for-azure-custom-ipv6-prefixes/", "url": "https://update.dsesecurity.com/updates/dse-20260917-173-use-the-documented-parent-and-child-sizes-for-azure-custom-ipv6-prefixes/", "headline": "Use the documented parent-and-child sizes for Azure custom IPv6 prefixes", "description": "Keep global allocation, regional allocation and usable public prefixes distinct.", "abstract": "Keep global allocation, regional allocation and usable public prefixes distinct.", "articleBody": "Source facts\nMicrosoft’s custom IPv6 prefix model uses a /48 global parent and /64 regional children. Multiple children can exist in a region, and the global range is the one validated for ownership. The guide also limits public IPv6 prefixes derived from a regional child to the first 2,048 addresses of that /64. Microsoft Learn.\nApplicability\nReview this model before onboarding an organization-owned IPv6 range. Identify the real parent allocation, proposed regional children and derived public prefixes. Do not substitute the documentation’s sample prefix or assume every address in a regional /64 is available for derivation.\nDSE recommendation\nDSE recommends an allocation register showing the hierarchy and ownership of each range. Have the address-management owner validate containment and uniqueness, then reconcile planned public allocations with the documented usable subset. Record regional placement and commissioning responsibilities separately from ownership verification. Resolve allocation assumptions before provisioning resources that depend on them.\nVerification\nCompare the created parent, children and derived public prefixes with the approved register. Confirm their resource identities, ranges and intended regions. Test only the authorized allocated endpoints and retain the resulting evidence. Keep provisioning and commissioning status distinct from proof that the applications behind the addresses are ready for traffic.\nOfficial references\nMicrosoft Learn: Create a custom IPv6 address prefix in Azure.", "datePublished": "2026-09-17T16:32:07+00:00", "dateModified": "2026-09-17T16:46:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-173-use-the-documented-parent-and-child-sizes-for-azure-custom-ipv6-prefixes/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-173-use-the-documented-parent-and-child-sizes-for-azure-custom-ipv6-prefixes/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Use the documented parent-and-child sizes for Azure custom IPv6 prefixes" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 207, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create a custom IPv6 address prefix in Azure - Azure Virtual Network | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/create-custom-ip-address-prefix-ipv6-portal" } } ] } }