diff --git a/avm/res/network/public-ip-address/README.md b/avm/res/network/public-ip-address/README.md
index 7e00e44faa..ded4ce7179 100644
--- a/avm/res/network/public-ip-address/README.md
+++ b/avm/res/network/public-ip-address/README.md
@@ -459,14 +459,32 @@ The DDoS protection plan configuration associated with the public IP address.
 
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
-| [`ddosProtectionPlan`](#parameter-ddossettingsddosprotectionplan) | object | The DDoS protection plan associated with the public IP address. |
 | [`protectionMode`](#parameter-ddossettingsprotectionmode) | string | The DDoS protection policy customizations. |
 
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`ddosProtectionPlan`](#parameter-ddossettingsddosprotectionplan) | object | The DDoS protection plan associated with the public IP address. |
+
+### Parameter: `ddosSettings.protectionMode`
+
+The DDoS protection policy customizations.
+
+- Required: Yes
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Enabled'
+  ]
+  ```
+
 ### Parameter: `ddosSettings.ddosProtectionPlan`
 
 The DDoS protection plan associated with the public IP address.
 
-- Required: Yes
+- Required: No
 - Type: object
 
 **Required parameters**
@@ -482,19 +500,6 @@ The resource ID of the DDOS protection plan associated with the public IP addres
 - Required: Yes
 - Type: string
 
-### Parameter: `ddosSettings.protectionMode`
-
-The DDoS protection policy customizations.
-
-- Required: Yes
-- Type: string
-- Allowed:
-  ```Bicep
-  [
-    'Enabled'
-  ]
-  ```
-
 ### Parameter: `diagnosticSettings`
 
 The diagnostic settings of the service.
diff --git a/avm/res/network/public-ip-address/main.bicep b/avm/res/network/public-ip-address/main.bicep
index 8b2bb3d8e7..b7970c5543 100644
--- a/avm/res/network/public-ip-address/main.bicep
+++ b/avm/res/network/public-ip-address/main.bicep
@@ -109,24 +109,23 @@ var builtInRoleNames = {
   )
 }
 
-resource avmTelemetry 'Microsoft.Resources/deployments@2023-07-01' =
-  if (enableTelemetry) {
-    name: '46d3xbcp.res.network-publicipaddress.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}'
-    properties: {
-      mode: 'Incremental'
-      template: {
-        '$schema': 'https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#'
-        contentVersion: '1.0.0.0'
-        resources: []
-        outputs: {
-          telemetry: {
-            type: 'String'
-            value: 'For more information, see https://aka.ms/avm/TelemetryInfo'
-          }
+resource avmTelemetry 'Microsoft.Resources/deployments@2023-07-01' = if (enableTelemetry) {
+  name: '46d3xbcp.res.network-publicipaddress.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}'
+  properties: {
+    mode: 'Incremental'
+    template: {
+      '$schema': 'https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#'
+      contentVersion: '1.0.0.0'
+      resources: []
+      outputs: {
+        telemetry: {
+          type: 'String'
+          value: 'For more information, see https://aka.ms/avm/TelemetryInfo'
         }
       }
     }
   }
+}
 
 resource publicIpAddress 'Microsoft.Network/publicIPAddresses@2023-09-01' = {
   name: name
@@ -152,17 +151,16 @@ resource publicIpAddress 'Microsoft.Network/publicIPAddresses@2023-09-01' = {
   }
 }
 
-resource publicIpAddress_lock 'Microsoft.Authorization/locks@2020-05-01' =
-  if (!empty(lock ?? {}) && lock.?kind != 'None') {
-    name: lock.?name ?? 'lock-${name}'
-    properties: {
-      level: lock.?kind ?? ''
-      notes: lock.?kind == 'CanNotDelete'
-        ? 'Cannot delete resource or child resources.'
-        : 'Cannot delete or modify the resource or child resources.'
-    }
-    scope: publicIpAddress
+resource publicIpAddress_lock 'Microsoft.Authorization/locks@2020-05-01' = if (!empty(lock ?? {}) && lock.?kind != 'None') {
+  name: lock.?name ?? 'lock-${name}'
+  properties: {
+    level: lock.?kind ?? ''
+    notes: lock.?kind == 'CanNotDelete'
+      ? 'Cannot delete resource or child resources.'
+      : 'Cannot delete or modify the resource or child resources.'
   }
+  scope: publicIpAddress
+}
 
 resource publicIpAddress_roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [
   for (roleAssignment, index) in (roleAssignments ?? []): {
@@ -278,11 +276,11 @@ type dnsSettingsType = {
 }
 
 type ddosSettingsType = {
-  @description('Required. The DDoS protection plan associated with the public IP address.')
+  @description('Optional. The DDoS protection plan associated with the public IP address.')
   ddosProtectionPlan: {
     @description('Required. The resource ID of the DDOS protection plan associated with the public IP address.')
     id: string
-  }
+  }?
   @description('Required. The DDoS protection policy customizations.')
   protectionMode: 'Enabled'
 }
diff --git a/avm/res/network/public-ip-address/main.json b/avm/res/network/public-ip-address/main.json
index 9bb75070c4..17558f4852 100644
--- a/avm/res/network/public-ip-address/main.json
+++ b/avm/res/network/public-ip-address/main.json
@@ -5,8 +5,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.26.54.24096",
-      "templateHash": "1650798617817777444"
+      "version": "0.27.1.19265",
+      "templateHash": "7382635530474884069"
     },
     "name": "Public IP Addresses",
     "description": "This module deploys a Public IP Address.",
@@ -155,8 +155,9 @@
               }
             }
           },
+          "nullable": true,
           "metadata": {
-            "description": "Required. The DDoS protection plan associated with the public IP address."
+            "description": "Optional. The DDoS protection plan associated with the public IP address."
           }
         },
         "protectionMode": {