# Complete custom-prefix decommissioning before changing its route-origin authorization

> Track advertisement removal as an asynchronous network transition.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-124-complete-custom-prefix-decommissioning-before-changing-its-route-origin/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:56+00:00
- Modified: 2026-09-17T16:42:36+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Track advertisement removal as an asynchronous network transition.

## Potentially affected

Use this review for an approved custom-prefix retirement or migration. Identify the prefix model, linked public prefixes, current commissioning state, external advertisements and the owner who controls the ROA. Consult the model-specific prerequisites before starting removal.

## DSE recommendation

DSE recommends a coordinated sequence with an explicit handoff between the Azure network owner and the address-registration owner.

## Article

## Source facts

Microsoft strongly recommends decommissioning a custom IP prefix before modifying or deleting its route-origin authorization. Its guidance warns that otherwise Microsoft may still advertise the range after authorization is removed. Decommissioning is asynchronous, and advertisement removal is gradual while the prefix remains in the Decommissioning state. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/manage-custom-ip-address-prefix).

## Applicability

Use this review for an approved custom-prefix retirement or migration. Identify the prefix model, linked public prefixes, current commissioning state, external advertisements and the owner who controls the ROA. Consult the model-specific prerequisites before starting removal.

## DSE recommendation

DSE recommends a coordinated sequence with an explicit handoff between the Azure network owner and the address-registration owner. Document the state evidence required before the ROA change. Keep application cutover, advertisement withdrawal and resource deletion as separately tracked actions. Preserve the migration plan and recovery decision rather than assuming that submitting decommissioning completes the withdrawal.

## Verification

Observe the prefix’s actual state until the documented transition is complete. Correlate it with authorized route observations and the intended application cutover. Have the responsible owner confirm the ROA action occurs at the agreed point. Record timestamps and remaining advertisements, and investigate discrepancies before declaring the range retired from Azure.

## Official references

[Microsoft Learn: Manage a custom IP address prefix](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/manage-custom-ip-address-prefix).

## Primary reference

- Name: Manage a custom IP address prefix - Azure Virtual Network | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/manage-custom-ip-address-prefix
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Complete custom-prefix decommissioning before changing its route-origin authorization,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-124-complete-custom-prefix-decommissioning-before-changing-its-route-origin/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.