# Use the documented parent-and-child sizes for Azure custom IPv6 prefixes

> Keep global allocation, regional allocation and usable public prefixes distinct.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-173-use-the-documented-parent-and-child-sizes-for-azure-custom-ipv6-prefixes/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:07+00:00
- Modified: 2026-09-17T16:46:29+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Keep global allocation, regional allocation and usable public prefixes distinct.

## Potentially affected

Review this model before onboarding an organization-owned IPv6 range. Identify the real parent allocation, proposed regional children and derived public prefixes. Do not substitute the documentation's sample prefix or assume every address in a regional /64 is available for derivation.

## DSE recommendation

DSE recommends an allocation register showing the hierarchy and ownership of each range.

## Article

## Source facts

Microsoft’s custom IPv6 prefix model uses a /48 global parent and /64 regional children. Multiple children can exist in a region, and the global range is the one validated for ownership. The guide also limits public IPv6 prefixes derived from a regional child to the first 2,048 addresses of that /64. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/create-custom-ip-address-prefix-ipv6-portal).

## Applicability

Review this model before onboarding an organization-owned IPv6 range. Identify the real parent allocation, proposed regional children and derived public prefixes. Do not substitute the documentation’s sample prefix or assume every address in a regional /64 is available for derivation.

## DSE recommendation

DSE recommends an allocation register showing the hierarchy and ownership of each range. Have the address-management owner validate containment and uniqueness, then reconcile planned public allocations with the documented usable subset. Record regional placement and commissioning responsibilities separately from ownership verification. Resolve allocation assumptions before provisioning resources that depend on them.

## Verification

Compare the created parent, children and derived public prefixes with the approved register. Confirm their resource identities, ranges and intended regions. Test only the authorized allocated endpoints and retain the resulting evidence. Keep provisioning and commissioning status distinct from proof that the applications behind the addresses are ready for traffic.

## Official references

[Microsoft Learn: Create a custom IPv6 address prefix in Azure](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/create-custom-ip-address-prefix-ipv6-portal).

## Primary reference

- Name: Create a custom IPv6 address prefix in Azure - Azure Virtual Network | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/create-custom-ip-address-prefix-ipv6-portal
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Use the documented parent-and-child sizes for Azure custom IPv6 prefixes,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-173-use-the-documented-parent-and-child-sizes-for-azure-custom-ipv6-prefixes/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.