Public IP basic SKU - What's the actual risk?

[gilblumberg]

I was offering advice to someone recently about when to use a basic or standard SKU public IP address. The one thing I couldn't really explain was when the documenation states that basic is "open by default."

I theoritically understand what this means, but not in practise. ie. If there aren't any ports opened on the VM, does this pose any actual concern? And even if I did have ports open on the VM, what's the impact of having NIC being "open by default" ? As compared if this was using the Standard SKU?

[#2]

Public IP addresses allow Internet resources to communicate inbound to Azure resources.Inbound communication from the Internet to the resource, such as Azure Virtual Machines (VM), Azure Application Gateways, Azure Load Balancers, Azure VPN Gateways, and others.

Ref: how Azure Public IP completely maps to the Azure Security Benchmark, see the full Azure Public IP security baseline mapping file. https://github.com/MicrosoftDocs/SecurityBenchmarks/raw/master/Azure%20Offer%20Security%20Baselines/...

In terms of Security aspects, Standard Public SKU is Secure by default model and be closed to inbound traffic when used as a frontend. Allow traffic with network security group (NSG) is required (for example, on the NIC of a virtual machine with a Standard SKU Public IP attached)., Whereas the Basic SKU is Open by default. Network security groups are recommended but optional for restricting inbound or outbound traffic.

[#3]

Thanks for taking the time to write this.
But you haven’t mentioned anything I didn’t already know.

I want to know a specific scenario/use case in which using a basic sku public IP offers less protection for a VM