{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-214-design-the-access-path-for-a-dedicated-wac-gateway-in-azure/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-214-design-the-access-path-for-a-dedicated-wac-gateway-in-azure/", "slug": "dse-20260908-214-design-the-access-path-for-a-dedicated-wac-gateway-in-azure", "url": "https://update.dsesecurity.com/updates/dse-20260908-214-design-the-access-path-for-a-dedicated-wac-gateway-in-azure/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-214-design-the-access-path-for-a-dedicated-wac-gateway-in-azure.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-214-design-the-access-path-for-a-dedicated-wac-gateway-in-azure/" }, "title": "Design the access path for a dedicated WAC gateway in Azure", "summary": "What should be reviewed before hosting a Windows Admin Center gateway on an Azure VM?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:13:37+00:00", "modified_at": "2026-09-08T18:29:33+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 219, "potentially_affected": "Administrators deploying an Azure-hosted Windows Admin Center gateway to manage multiple VMs.", "dse_recommendation": "Prepare the resource, certificate, and network-access plan before running a deployment script.", "primary_source": { "name": "Deploy a Windows Admin Center gateway in Azure", "url": "https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/deploy-wac-in-azure", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft distinguishes deploying a dedicated WAC gateway on an Azure VM for multiple VMs from using the portal experience for one VM. Its deployment script can create the environment, including the resource group. The documented gateway needs HTTPS access on port 443. Microsoft recommends limiting self-signed gateway certificates to test environments. Microsoft Learn.

\n

Applicability

\n

Choose the dedicated-gateway deployment deliberately and identify its intended operators and managed machines. Review the current script parameters, certificate guidance, and network requirements. Keep a gateway VM deployment separate from enabling the portal extension on an individual server.

\n

DSE recommendation

\n

Prepare the resource, certificate, and network-access plan before running a deployment script. Have the Azure owner review every resource the selected parameters may create and the scope of allowed HTTPS clients. Assign an owner for the gateway name and certificate renewal. Use a controlled pilot and retain a documented management alternative while the gateway is being introduced.

\n

Verification

\n

Verify the created resources against the approved plan and connect using the intended DNS name and trusted certificate. Test one authorized managed VM and an unauthorized gateway user. Review the actual network exposure and any unexpected created resource. Accept the gateway only after its management path and operational ownership are clear.

\n

Official references

\n

Microsoft Learn: Deploy a Windows Admin Center gateway in Azure. Source reviewed September 8, 2026.

", "content_text": "Source facts\nMicrosoft distinguishes deploying a dedicated WAC gateway on an Azure VM for multiple VMs from using the portal experience for one VM. Its deployment script can create the environment, including the resource group. The documented gateway needs HTTPS access on port 443. Microsoft recommends limiting self-signed gateway certificates to test environments. Microsoft Learn.\nApplicability\nChoose the dedicated-gateway deployment deliberately and identify its intended operators and managed machines. Review the current script parameters, certificate guidance, and network requirements. Keep a gateway VM deployment separate from enabling the portal extension on an individual server.\nDSE recommendation\nPrepare the resource, certificate, and network-access plan before running a deployment script. Have the Azure owner review every resource the selected parameters may create and the scope of allowed HTTPS clients. Assign an owner for the gateway name and certificate renewal. Use a controlled pilot and retain a documented management alternative while the gateway is being introduced.\nVerification\nVerify the created resources against the approved plan and connect using the intended DNS name and trusted certificate. Test one authorized managed VM and an unauthorized gateway user. Review the actual network exposure and any unexpected created resource. Accept the gateway only after its management path and operational ownership are clear.\nOfficial references\nMicrosoft Learn: Deploy a Windows Admin Center gateway in Azure. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nMicrosoft distinguishes deploying a dedicated WAC gateway on an Azure VM for multiple VMs from using the portal experience for one VM. Its deployment script can create the environment, including the resource group. The documented gateway needs HTTPS access on port 443. Microsoft recommends limiting self-signed gateway certificates to test environments. [Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/deploy-wac-in-azure).\n\n## Applicability\n\nChoose the dedicated-gateway deployment deliberately and identify its intended operators and managed machines. Review the current script parameters, certificate guidance, and network requirements. Keep a gateway VM deployment separate from enabling the portal extension on an individual server.\n\n## DSE recommendation\n\nPrepare the resource, certificate, and network-access plan before running a deployment script. Have the Azure owner review every resource the selected parameters may create and the scope of allowed HTTPS clients. Assign an owner for the gateway name and certificate renewal. Use a controlled pilot and retain a documented management alternative while the gateway is being introduced.\n\n## Verification\n\nVerify the created resources against the approved plan and connect using the intended DNS name and trusted certificate. Test one authorized managed VM and an unauthorized gateway user. Review the actual network exposure and any unexpected created resource. Accept the gateway only after its management path and operational ownership are clear.\n\n## Official references\n\n[Microsoft Learn: Deploy a Windows Admin Center gateway in Azure](https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/deploy-wac-in-azure). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-214-design-the-access-path-for-a-dedicated-wac-gateway-in-azure/", "url": "https://update.dsesecurity.com/updates/dse-20260908-214-design-the-access-path-for-a-dedicated-wac-gateway-in-azure/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-214-design-the-access-path-for-a-dedicated-wac-gateway-in-azure/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Design the access path for a dedicated WAC gateway in Azure", "item": "https://update.dsesecurity.com/updates/dse-20260908-214-design-the-access-path-for-a-dedicated-wac-gateway-in-azure/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-214-design-the-access-path-for-a-dedicated-wac-gateway-in-azure/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-214-design-the-access-path-for-a-dedicated-wac-gateway-in-azure/", "url": "https://update.dsesecurity.com/updates/dse-20260908-214-design-the-access-path-for-a-dedicated-wac-gateway-in-azure/", "headline": "Design the access path for a dedicated WAC gateway in Azure", "description": "What should be reviewed before hosting a Windows Admin Center gateway on an Azure VM?", "abstract": "What should be reviewed before hosting a Windows Admin Center gateway on an Azure VM?", "articleBody": "Source facts\nMicrosoft distinguishes deploying a dedicated WAC gateway on an Azure VM for multiple VMs from using the portal experience for one VM. Its deployment script can create the environment, including the resource group. The documented gateway needs HTTPS access on port 443. Microsoft recommends limiting self-signed gateway certificates to test environments. Microsoft Learn.\nApplicability\nChoose the dedicated-gateway deployment deliberately and identify its intended operators and managed machines. Review the current script parameters, certificate guidance, and network requirements. Keep a gateway VM deployment separate from enabling the portal extension on an individual server.\nDSE recommendation\nPrepare the resource, certificate, and network-access plan before running a deployment script. Have the Azure owner review every resource the selected parameters may create and the scope of allowed HTTPS clients. Assign an owner for the gateway name and certificate renewal. Use a controlled pilot and retain a documented management alternative while the gateway is being introduced.\nVerification\nVerify the created resources against the approved plan and connect using the intended DNS name and trusted certificate. Test one authorized managed VM and an unauthorized gateway user. Review the actual network exposure and any unexpected created resource. Accept the gateway only after its management path and operational ownership are clear.\nOfficial references\nMicrosoft Learn: Deploy a Windows Admin Center gateway in Azure. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:13:37+00:00", "dateModified": "2026-09-08T18:29:33+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-214-design-the-access-path-for-a-dedicated-wac-gateway-in-azure/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-214-design-the-access-path-for-a-dedicated-wac-gateway-in-azure/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Design the access path for a dedicated WAC gateway in Azure" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 219, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Deploy a Windows Admin Center gateway in Azure", "url": "https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/deploy-wac-in-azure" } } ] } }