---
title: "Migrating from Machine-scoped to App-scoped Egress IPs"
description: "Promote a Machine-scoped egress IP to an app-scoped one yourself with fly m egress-ip promote, in flyctl v0.4.37 and later."
date: "2026-04-21"
author: "Peter Cai"
url: "https://fly.io/changelog/app-scoped-egress-ip-migration/"
discussion: "https://community.fly.io/t/migrating-from-machine-scoped-to-app-scoped-egress-ips/27677"
---

# Migrating from Machine-scoped to App-scoped Egress IPs

We shipped [app-scoped egress IPs](https://community.fly.io/t/beta-feature-try-out-app-scoped-egress-ips/26536) a while back for customers who need fixed IPs to pass external allowlists without having to bind static IPs to individual machines and hinder bluegreen deployments in the process. Despite a few wrinkles, we think this has been working more reliably than machine-scoped egress IPs, and is, in general, a much less confusing experience (no more "I did a `fly deploy`, where did my egress IPs go???").

As such, we would like to move towards deprecating machine-scoped egress IPs in the not so distant future. But before that, a common request we have received when we recommend app-scoped egress IPs to existing users is that "can you make my machine-scoped egress IP `X` an app-scoped one?". We have been doing this manually per request up until this point; but if you update to [flyctl release v0.4.37](https://github.com/superfly/flyctl/releases/tag/v0.4.37) (or later), you can now do this yourself with `fly m egress-ip promote`. For more details, see our [updated documentation](https://fly.io/docs/networking/egress-ips/#migrate-to-app-scoped-egress-ips).

Along with this change we have also removed the command in `flyctl` to allocate new machine-scoped egress IPs. This is, however, not a full deprecation announcement: the GraphQL endpoint for allocating these IPs still exists, and existing machine-scoped egress IPs will continue to function. We will announce a concrete deprecation schedule once a decent amount of users have upgraded to newer `flyctl` versions and make use of the `fly m egress-ip promote` process.