App GW IP exhaust issue

Thanks again for providing the best possible answers.

I would like to share an update from my testing. I ran my workflow by selecting a static frontend IP, and the deployment was successful. During troubleshooting, I discovered that there were 3 hidden IPs in the subnet.

I also found that App Gateway instance IPs are not assigned sequentially; instead, they are allocated randomly. Because of this behavior, those 3 IPs appeared hidden within the subnet.

Now, I have successfully provisioned my 9th Application Gateway, and it is working correctly as per the expected calculations.

The reason for the previous failures was that I was assigning a static frontend IP from the subnet that was already being utilized internally by one of the App Gateway instances. As a result, I had to rerun the workflow around 10–12 times using different frontend IPs from the subnet before achieving success.

Since NICs are not directly visible or involved in the case of Application Gateway, there should ideally be some mechanism to identify which IPs are already utilized internally and which are free for frontend assignment.

I hope Microsoft or any senior solution architect can provide guidance on this issue so that such deployment challenges can be avoided in the future.

Kumar, Jitendra hi & thx for join me here at Q&A portal,

so.......... /27 math looks ok on paper but App Gateway needs hidden scale/upgrade IPs, use bigger subnet.... I guess /27 is too tight for 8 App Gateways already. Azure reserves 5 IPs in every subnet, so /27 gives u 32 total minus 5 = 27 usable IPs. App Gateway v2 can consume more than just 1 frontend IP. it needs private instance IPs, frontend IPs if private, scaling headroom up to max instance count, plus upgrade/maintenance headroom. with 8 gateways and max count 2, u are already near practical exhaustion. the fix is not finding “3 missing IPs”, its using a bigger dedicated subnet, ideally /24 for App Gateway v2 if u expect growth. to see usage, check subnet effective IP usage in portal or list NIC/IP configs tied to the subnet with Resource Graph / CLI, but App Gateway reserved instance IPs are not always obvious like normal NICs. practical move: create new larger subnet, deploy new App Gateways there or recreate/migrate gradually. u usually cant just shrink/expand subnet if address space around it is not free.

rgds, Alex

&

if my answer helps pls accept it.

Hello @Kumar, Jitendra,

Thank you for reaching out to Microsoft Q&A.

I understand you're hitting an IP exhaustion error while trying to deploy the 9th Application Gateway in your dedicated /27 subnet.

This is a common issue with Application Gateway v2 when using autoscaling. Even though each gateway is currently running with the minimum instance count of 1, Azure reserves IP addresses based on the maximum instance count you have configured (in your case, 2), plus one IP for the frontend configuration.

Quick Breakdown:

• A /27 subnet gives you 27 usable IPs (32 total minus 5 reserved by Azure).
• Each Application Gateway reserves: 1 frontend IP + Max instance count.
• With 8 gateways: 8 × (1 + 2) = 24 IPs already reserved for the gateways.

This leaves very little room for the 9th gateway, which is why you're seeing the error.

Recommended Solutions:

1. Best Long-term Option – Use a larger subnet Move (or create new gateways) in a bigger dedicated subnet, such as /26 or ideally /24. Microsoft recommends /24 for production workloads with autoscaling.
2. Short-term Option – Reduce Maximum instances Review your existing gateways and lower the Maximum instance count (e.g., to 1 or 2 only where really needed). This immediately frees up reserved IPs.

3. Check Current Usage You can quickly see the configuration of all your gateways using this CLI command:

az network application-gateway list --query "[].{Name:name, ResourceGroup:resourceGroup, MinScale:properties.autoscaleConfiguration.minCapacity, MaxScale:properties.autoscaleConfiguration.maxCapacity}" -o table

Reference:

• Application Gateway infrastructure configuration and subnet sizing
• Frontend IP configurations

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".