Complete custom-prefix decommissioning before changing its route-origin authorization

Source facts

Microsoft strongly recommends decommissioning a custom IP prefix before modifying or deleting its route-origin authorization. Its guidance warns that otherwise Microsoft may still advertise the range after authorization is removed. Decommissioning is asynchronous, and advertisement removal is gradual while the prefix remains in the Decommissioning state. Microsoft Learn.

Applicability

Use this review for an approved custom-prefix retirement or migration. Identify the prefix model, linked public prefixes, current commissioning state, external advertisements and the owner who controls the ROA. Consult the model-specific prerequisites before starting removal.

DSE recommendation

DSE recommends a coordinated sequence with an explicit handoff between the Azure network owner and the address-registration owner. Document the state evidence required before the ROA change. Keep application cutover, advertisement withdrawal and resource deletion as separately tracked actions. Preserve the migration plan and recovery decision rather than assuming that submitting decommissioning completes the withdrawal.

Verification

Observe the prefix’s actual state until the documented transition is complete. Correlate it with authorized route observations and the intended application cutover. Have the responsible owner confirm the ROA action occurs at the agreed point. Record timestamps and remaining advertisements, and investigate discrepancies before declaring the range retired from Azure.

Official references

Microsoft Learn: Manage a custom IP address prefix.