{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-130-preserve-the-vm-adapter-identity-before-starting-an-sdn-tenant-workload/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-130-preserve-the-vm-adapter-identity-before-starting-an-sdn-tenant-workload/", "slug": "dse-20260908-130-preserve-the-vm-adapter-identity-before-starting-an-sdn-tenant-workload", "url": "https://update.dsesecurity.com/updates/dse-20260908-130-preserve-the-vm-adapter-identity-before-starting-an-sdn-tenant-workload/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-130-preserve-the-vm-adapter-identity-before-starting-an-sdn-tenant-workload.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-130-preserve-the-vm-adapter-identity-before-starting-an-sdn-tenant-workload/" }, "title": "Preserve the VM adapter identity before starting an SDN tenant workload", "summary": "Which VM network-adapter identity must be established before an SDN-connected VM starts?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:15:01+00:00", "modified_at": "2026-09-08T18:23:27+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 216, "potentially_affected": "Administrators attaching VMs to Microsoft SDN tenant networks or VLANs.", "dse_recommendation": "Prepare a binding record linking the VM adapter to its Network Controller interface and tenant network.", "primary_source": { "name": "Create a VM and connect to a tenant virtual network or VLAN", "url": "https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Create-a-Tenant-VM", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s procedure attaches a tenant VM either to a virtualized tenant network or to a VLAN. The VM adapter requires a static MAC address for the VM’s lifetime. A MAC change prevents Network Controller from configuring the required adapter policy and stops network communication. For a VM needing connectivity at startup, the source instructs administrators to set the interface identifier on the adapter port before starting it. Microsoft documentation.

\n

Applicability

\n

Identify the VM, adapter, controller interface resource, MAC address, target subnet, and startup dependencies. Replace the source’s sample identifiers with the approved values for this tenant.

\n

DSE recommendation

\n

Prepare a binding record linking the VM adapter to its Network Controller interface and tenant network. Have the platform and network owners review those identities before first boot. Define how the binding will be maintained if the VM is moved or its adapter is recreated.

\n

Verification

\n

Inspect the identities before startup, then test the intended tenant communication from the guest. Compare the observed policy association and network path with the binding record. Treat a changed MAC or missing interface resource as an unresolved configuration issue before allowing the application to depend on that connection.

\n

Official references

\n

Microsoft Learn: Create a VM and connect to a tenant virtual network or VLAN. Source reviewed September 8, 2026.

", "content_text": "Source facts\nMicrosoft’s procedure attaches a tenant VM either to a virtualized tenant network or to a VLAN. The VM adapter requires a static MAC address for the VM’s lifetime. A MAC change prevents Network Controller from configuring the required adapter policy and stops network communication. For a VM needing connectivity at startup, the source instructs administrators to set the interface identifier on the adapter port before starting it. Microsoft documentation.\nApplicability\nIdentify the VM, adapter, controller interface resource, MAC address, target subnet, and startup dependencies. Replace the source’s sample identifiers with the approved values for this tenant.\nDSE recommendation\nPrepare a binding record linking the VM adapter to its Network Controller interface and tenant network. Have the platform and network owners review those identities before first boot. Define how the binding will be maintained if the VM is moved or its adapter is recreated.\nVerification\nInspect the identities before startup, then test the intended tenant communication from the guest. Compare the observed policy association and network path with the binding record. Treat a changed MAC or missing interface resource as an unresolved configuration issue before allowing the application to depend on that connection.\nOfficial references\nMicrosoft Learn: Create a VM and connect to a tenant virtual network or VLAN. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nMicrosoft’s procedure attaches a tenant VM either to a virtualized tenant network or to a VLAN. The VM adapter requires a static MAC address for the VM’s lifetime. A MAC change prevents Network Controller from configuring the required adapter policy and stops network communication. For a VM needing connectivity at startup, the source instructs administrators to set the interface identifier on the adapter port before starting it. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Create-a-Tenant-VM).\n\n## Applicability\n\nIdentify the VM, adapter, controller interface resource, MAC address, target subnet, and startup dependencies. Replace the source’s sample identifiers with the approved values for this tenant.\n\n## DSE recommendation\n\nPrepare a binding record linking the VM adapter to its Network Controller interface and tenant network. Have the platform and network owners review those identities before first boot. Define how the binding will be maintained if the VM is moved or its adapter is recreated.\n\n## Verification\n\nInspect the identities before startup, then test the intended tenant communication from the guest. Compare the observed policy association and network path with the binding record. Treat a changed MAC or missing interface resource as an unresolved configuration issue before allowing the application to depend on that connection.\n\n## Official references\n\n[Microsoft Learn: Create a VM and connect to a tenant virtual network or VLAN](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Create-a-Tenant-VM). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-130-preserve-the-vm-adapter-identity-before-starting-an-sdn-tenant-workload/", "url": "https://update.dsesecurity.com/updates/dse-20260908-130-preserve-the-vm-adapter-identity-before-starting-an-sdn-tenant-workload/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-130-preserve-the-vm-adapter-identity-before-starting-an-sdn-tenant-workload/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Preserve the VM adapter identity before starting an SDN tenant workload", "item": "https://update.dsesecurity.com/updates/dse-20260908-130-preserve-the-vm-adapter-identity-before-starting-an-sdn-tenant-workload/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-130-preserve-the-vm-adapter-identity-before-starting-an-sdn-tenant-workload/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-130-preserve-the-vm-adapter-identity-before-starting-an-sdn-tenant-workload/", "url": "https://update.dsesecurity.com/updates/dse-20260908-130-preserve-the-vm-adapter-identity-before-starting-an-sdn-tenant-workload/", "headline": "Preserve the VM adapter identity before starting an SDN tenant workload", "description": "Which VM network-adapter identity must be established before an SDN-connected VM starts?", "abstract": "Which VM network-adapter identity must be established before an SDN-connected VM starts?", "articleBody": "Source facts\nMicrosoft’s procedure attaches a tenant VM either to a virtualized tenant network or to a VLAN. The VM adapter requires a static MAC address for the VM’s lifetime. A MAC change prevents Network Controller from configuring the required adapter policy and stops network communication. For a VM needing connectivity at startup, the source instructs administrators to set the interface identifier on the adapter port before starting it. Microsoft documentation.\nApplicability\nIdentify the VM, adapter, controller interface resource, MAC address, target subnet, and startup dependencies. Replace the source’s sample identifiers with the approved values for this tenant.\nDSE recommendation\nPrepare a binding record linking the VM adapter to its Network Controller interface and tenant network. Have the platform and network owners review those identities before first boot. Define how the binding will be maintained if the VM is moved or its adapter is recreated.\nVerification\nInspect the identities before startup, then test the intended tenant communication from the guest. Compare the observed policy association and network path with the binding record. Treat a changed MAC or missing interface resource as an unresolved configuration issue before allowing the application to depend on that connection.\nOfficial references\nMicrosoft Learn: Create a VM and connect to a tenant virtual network or VLAN. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:15:01+00:00", "dateModified": "2026-09-08T18:23:27+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-130-preserve-the-vm-adapter-identity-before-starting-an-sdn-tenant-workload/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-130-preserve-the-vm-adapter-identity-before-starting-an-sdn-tenant-workload/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Preserve the VM adapter identity before starting an SDN tenant workload" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 216, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create a VM and connect to a tenant virtual network or VLAN", "url": "https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Create-a-Tenant-VM" } } ] } }