{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-013-separate-machine-configuration-service-access-from-custom-package-access/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-013-separate-machine-configuration-service-access-from-custom-package-access/", "slug": "dse-20260909-013-separate-machine-configuration-service-access-from-custom-package-access", "url": "https://update.dsesecurity.com/updates/dse-20260909-013-separate-machine-configuration-service-access-from-custom-package-access/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-013-separate-machine-configuration-service-access-from-custom-package-access.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-013-separate-machine-configuration-service-access-from-custom-package-access/" }, "title": "Separate Machine Configuration service access from custom package access", "summary": "Review the service path and package location separately when restricting Machine Configuration network access.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:31:43+00:00", "modified_at": "2026-09-10T00:32:00+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 223, "potentially_affected": "Azure VMs and Arc-enabled servers using Machine Configuration.", "dse_recommendation": "Record the service connection and every custom package location before approving egress restrictions.", "primary_source": { "name": "Azure Machine Configuration network requirements - Azure Machine Configuration | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/machine-configuration/overview/03-network-requirements", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For the Azure virtual-network path, Microsoft requires outbound port 443 access and identifies both AzureArcInfrastructure and Storage service tags. Storage is needed because it hosts configuration packages.

\n

Azure VMs using the documented private-link path do not need publicly reachable regional GAS endpoints. However, a custom package at a public Storage or non-Azure URL still needs a reachable, allowed URL. Built-in packages on Arc-enabled servers using private link follow that link without additional server tags.

\n

The Arc built-in-package behavior is documented separately from the Azure VM tagging procedure. Microsoft Learn.

\n

Applicability

\n

Identify whether each target is an Azure VM or an Arc-enabled server, and whether its package is built in or custom. Do not copy one platform’s network assumptions to the other.

\n

DSE recommendation

\n

DSE recommends a two-column access record: service communication and package download. Record the actual package URI from the assignment, its hosting boundary, and the approved route. Review public package dependencies before closing egress. Ask the configuration owner to identify a representative assignment for each distinct package-hosting pattern.

\n

Verification

\n

On approved test machines, compare service reporting with package retrieval and assignment execution. Preserve the target type, assignment, observed destination, and outcome separately. Investigate a successful service connection alongside a failed package download before declaring the restricted design ready.

\n

Official references

\n

Microsoft Learn: Azure Machine Configuration network requirements. Source retrieved September 9, 2026.

", "content_text": "Source facts\nFor the Azure virtual-network path, Microsoft requires outbound port 443 access and identifies both AzureArcInfrastructure and Storage service tags. Storage is needed because it hosts configuration packages.\nAzure VMs using the documented private-link path do not need publicly reachable regional GAS endpoints. However, a custom package at a public Storage or non-Azure URL still needs a reachable, allowed URL. Built-in packages on Arc-enabled servers using private link follow that link without additional server tags.\nThe Arc built-in-package behavior is documented separately from the Azure VM tagging procedure. Microsoft Learn.\nApplicability\nIdentify whether each target is an Azure VM or an Arc-enabled server, and whether its package is built in or custom. Do not copy one platform’s network assumptions to the other.\nDSE recommendation\nDSE recommends a two-column access record: service communication and package download. Record the actual package URI from the assignment, its hosting boundary, and the approved route. Review public package dependencies before closing egress. Ask the configuration owner to identify a representative assignment for each distinct package-hosting pattern.\nVerification\nOn approved test machines, compare service reporting with package retrieval and assignment execution. Preserve the target type, assignment, observed destination, and outcome separately. Investigate a successful service connection alongside a failed package download before declaring the restricted design ready.\nOfficial references\nMicrosoft Learn: Azure Machine Configuration network requirements. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nFor the Azure virtual-network path, Microsoft requires outbound port 443 access and identifies both AzureArcInfrastructure and Storage service tags. Storage is needed because it hosts configuration packages.\n\nAzure VMs using the documented private-link path do not need publicly reachable regional GAS endpoints. However, a custom package at a public Storage or non-Azure URL still needs a reachable, allowed URL. Built-in packages on Arc-enabled servers using private link follow that link without additional server tags.\n\nThe Arc built-in-package behavior is documented separately from the Azure VM tagging procedure. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/overview/03-network-requirements).\n\n## Applicability\n\nIdentify whether each target is an Azure VM or an Arc-enabled server, and whether its package is built in or custom. Do not copy one platform’s network assumptions to the other.\n\n## DSE recommendation\n\nDSE recommends a two-column access record: service communication and package download. Record the actual package URI from the assignment, its hosting boundary, and the approved route. Review public package dependencies before closing egress. Ask the configuration owner to identify a representative assignment for each distinct package-hosting pattern.\n\n## Verification\n\nOn approved test machines, compare service reporting with package retrieval and assignment execution. Preserve the target type, assignment, observed destination, and outcome separately. Investigate a successful service connection alongside a failed package download before declaring the restricted design ready.\n\n## Official references\n\n[Microsoft Learn: Azure Machine Configuration network requirements](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/overview/03-network-requirements). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-013-separate-machine-configuration-service-access-from-custom-package-access/", "url": "https://update.dsesecurity.com/updates/dse-20260909-013-separate-machine-configuration-service-access-from-custom-package-access/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-013-separate-machine-configuration-service-access-from-custom-package-access/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Separate Machine Configuration service access from custom package access", "item": "https://update.dsesecurity.com/updates/dse-20260909-013-separate-machine-configuration-service-access-from-custom-package-access/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-013-separate-machine-configuration-service-access-from-custom-package-access/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-013-separate-machine-configuration-service-access-from-custom-package-access/", "url": "https://update.dsesecurity.com/updates/dse-20260909-013-separate-machine-configuration-service-access-from-custom-package-access/", "headline": "Separate Machine Configuration service access from custom package access", "description": "Review the service path and package location separately when restricting Machine Configuration network access.", "abstract": "Review the service path and package location separately when restricting Machine Configuration network access.", "articleBody": "Source facts\nFor the Azure virtual-network path, Microsoft requires outbound port 443 access and identifies both AzureArcInfrastructure and Storage service tags. Storage is needed because it hosts configuration packages.\nAzure VMs using the documented private-link path do not need publicly reachable regional GAS endpoints. However, a custom package at a public Storage or non-Azure URL still needs a reachable, allowed URL. Built-in packages on Arc-enabled servers using private link follow that link without additional server tags.\nThe Arc built-in-package behavior is documented separately from the Azure VM tagging procedure. Microsoft Learn.\nApplicability\nIdentify whether each target is an Azure VM or an Arc-enabled server, and whether its package is built in or custom. Do not copy one platform’s network assumptions to the other.\nDSE recommendation\nDSE recommends a two-column access record: service communication and package download. Record the actual package URI from the assignment, its hosting boundary, and the approved route. Review public package dependencies before closing egress. Ask the configuration owner to identify a representative assignment for each distinct package-hosting pattern.\nVerification\nOn approved test machines, compare service reporting with package retrieval and assignment execution. Preserve the target type, assignment, observed destination, and outcome separately. Investigate a successful service connection alongside a failed package download before declaring the restricted design ready.\nOfficial references\nMicrosoft Learn: Azure Machine Configuration network requirements. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:31:43+00:00", "dateModified": "2026-09-10T00:32:00+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-013-separate-machine-configuration-service-access-from-custom-package-access/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-013-separate-machine-configuration-service-access-from-custom-package-access/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate Machine Configuration service access from custom package access" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 223, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Azure Machine Configuration network requirements - Azure Machine Configuration | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/machine-configuration/overview/03-network-requirements" } } ] } }