APIM zone redundant changes

Question

APIM zone redundant changes

Eddie Vincent 245

Scenario: Upgrading an older version of APIM (pre 2024) to add zone redundancy/resiliency.

Platform version stv2.1.
Premium SKU.
VNet injected APIM version.
Standard public IP address (pre-zone redundancy feature).
Internal VNet option: https://learn.microsoft.com/en-us/azure/api-management/api-management-using-with-internal-vnet
Deploying via code (not Azure portal) preferred.
APIM is within a supported region for this setup.
Wanting to change the public IP address to zone redundant and the "locations" section within APIM itself - units and availability zones section as can be seen below.

User's image

With the above points in mind I am looking for the best way of doing this, especially when taking into account the decoupled nature of the Public IP address and APIM instance (since the below is now apparently possible also).

User's image

Questions include:

Is an APIM instance with the managed "no public IP" option (May 2024) only available for newly built APIM instances and not pre-existing?
If no then how would you upgrade to a managed option from pre-existing APIM?
If yes what are the concerns about future proofing the environment, were the non-managed/decoupled option ever to become EOL.

Appreciate any constructive responses, thanks!

Pravallika KV 2,845 Reputation points Microsoft External Staff Moderator

2025-10-23T08:46:15.4366667+00:00

Hi Eddie Vincent, following up to see if above provided response was helpful. If you have any further queries, do let us know.
Eddie Vincent 245 Reputation points

2025-10-23T11:34:58.8433333+00:00

All good with me, thankyou for your quick response.
Pravallika KV 2,845 Reputation points Microsoft External Staff Moderator

2025-10-23T11:47:35.6+00:00

Thanks for the confirmation @Eddie Vincent. I have posted the answer. Please accept as Yes if the answer is helpful so that it can help others in the community. If you any further queries, do let us know.

Answer accepted by question author

3 additional answers

Your answer

Pravallika KV 2,845 Reputation points Microsoft External Staff Moderator

2025-10-23T08:46:15.4366667+00:00

Hi Eddie Vincent, following up to see if above provided response was helpful. If you have any further queries, do let us know.
Eddie Vincent 245 Reputation points

2025-10-23T11:34:58.8433333+00:00

All good with me, thankyou for your quick response.
Pravallika KV 2,845 Reputation points Microsoft External Staff Moderator

2025-10-23T11:47:35.6+00:00

Thanks for the confirmation @Eddie Vincent. I have posted the answer. Please accept as Yes if the answer is helpful so that it can help others in the community. If you any further queries, do let us know.

Answer 1

Hi Eddie Vincent,

Thanks for reaching out to Microsoft Q&A,

Pre-2024 APIM instances cannot directly switch to the fully managed “no public IP” option; it’s only available for new deployments.
Zone redundancy requires adding multiple units and specifying availability zones in the locations section.
Existing public IPs can be decoupled, but upgrading to a managed zone-redundant IP usually requires creating a new IP.
Future-proofing favors using decoupled or managed IPs to simplify scaling and ensure resiliency.
Migration to a new managed APIM instance is recommended for full AZ and managed IP benefits.
Deployment via ARM/Bicep/terraform allows code-driven updates of units, zones, and public IP assignments.

Hope it helps!

Please do not forget to click "Accept the answer” and Yes, this can be beneficial to other community members.

User's image

If you have any other questions, let me know in the "comments" and I would be happy to help you.

Answer 2

Pravallika KV 2,845 Microsoft External Staff Moderator

Hi Eddie Vincent,

You’re right. Since this is a VNET injected APIM instance that was migrated from stv1 to stv2, this behavior is consistent with stale internal load balancer references from the old subnet configuration.

Moving the APIM instance back to its original subnet or a subnet with the same address range and NSG rules allows Azure to re-establish and clean up the underlying managed networking components that were created during the stv1 deployment.

And you don’t have to rebuild the APIM instance. Re-attaching it to the original or equivalent subnet is typically enough to resolve this issue and clear the phantom load balancer or IP association.

Once Azure completes the network re-application, you can verify the configuration and, if needed, move it back to your target subnet afterward.

Pravallika KV 2,845 Reputation points Microsoft External Staff Moderator

2025-11-06T09:46:38.7733333+00:00

@Eddie Vincent , Glad it was helpful. If this answers your query, do click Accept Answer and Yes, if you have any further queries do let us know.

Answer 3

Eddie Vincent 245

@Pravallika KV

One more question for you, are you aware why when I try and disassociate the public IP address from APIM it tells me to disassociate first from a loadbalancer which (as far as I can see) does not exist in my Azure tenant.

User's image

On clicking the link for this phantom load balancer I am provided with an error of "The access token is from the wrong issuer" despite also being an Owner in RBAC for this subscription.

Is this something legacy from the older version of APIM/Public IP, or baked in? any thoughts would be appreciated.

Pravallika KV 2,845 Reputation points Microsoft External Staff Moderator

2025-11-05T06:55:28.57+00:00

Hi Eddie Vincent, I will check on this and update you.
Pravallika KV 2,845 Reputation points Microsoft External Staff Moderator

2025-11-05T12:23:19.1+00:00
Hi Eddie Vincent,

When you deploy an APIM instance in public network mode, Azure automatically creates and manages a Load Balancer and network interfaces that the public IP gets attached to. These resources live in a Microsoft-managed subscription, not in your tenant. Your visible Public IP in your subscription is just linked to that managed Load Balancer.

So, when you go to the Public IP resource and try to click “Disassociate”, Azure detects that it is still referenced by that internal Load Balancer and shows:

“This Public IP is associated with a Load Balancer. Disassociate it there first.”

but that Load Balancer is not in your subscription, which is why you can’t see it under Load Balancers in your portal.

This isn't a permissions issue, it's simply because that load balancer is a Microsoft-managed resource, and you cannot directly access or modify it.

The access token is from the wrong issuer

This error occurs when link points to a Microsoft-managed resource i.e., different Azure AD tenant/issuer context

Or when the resource no longer exists in your tenant, but the reference is still cached in metadata.

If you want to reuse or release the Public IP:

Delete the APIM instance using that IP.

Wait a few minutes for Azure to clean up managed network resources.

Then try deleting or reassigning the Public IP.

Please "Up Vote" if the information helped you. This will help us and others in the community as well. If you have any further queries, do let me know

Thank you.

Answer 4

Eddie Vincent 245

@Pravallika KV

In this case it is not a public facing APIM instance rather injected into a Vnet/Vnet integrated.

I would add though that historically it had been moved out of its original subnet to facilitate an upgrade from version 1 standard to version 2 standard APIM instance.

But looking at the link here: https://learn.microsoft.com/en-us/previous-versions/azure/api-management/migrate-stv1-to-stv2-vnet?wt.mc_id=knwlserapi_inproduct_azportal&tabs=portal#migrate-a-vnet-injected-api-management-instance-hosted-on-the-stv1-platform-to-stv2

User's image

There is a suggestion that adding back to the original subnet (or close equivalent I would presume) maybe an option- any thoughts?

User's image

Unfortunately as per your previous comment "Delete the APIM instance using that IP." if you mean completely flattening and rebuilding from scratch this isn't an option as it is a shared service - if I've misunderstood your point however let me know, Thanks!

Eddie Vincent 245 Reputation points

2025-11-06T09:11:26.5466667+00:00

@Pravallika KV very helpful response, thankyou!!
Pravallika KV 2,845 Reputation points Microsoft External Staff Moderator

2025-11-06T09:13:28.29+00:00

Eddie Vincent, Glad it was helpful. If this answers your query, do click Accept Answer and Yes, if you have any further queries do let us know.

Share via

APIM zone redundant changes

3 additional answers

Your answer