{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-086-do-not-plan-an-in-place-conversion-to-the-direct-shared-gallery-preview/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-086-do-not-plan-an-in-place-conversion-to-the-direct-shared-gallery-preview/", "slug": "dse-20260909-086-do-not-plan-an-in-place-conversion-to-the-direct-shared-gallery-preview", "url": "https://update.dsesecurity.com/updates/dse-20260909-086-do-not-plan-an-in-place-conversion-to-the-direct-shared-gallery-preview/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-086-do-not-plan-an-in-place-conversion-to-the-direct-shared-gallery-preview.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-086-do-not-plan-an-in-place-conversion-to-the-direct-shared-gallery-preview/" }, "title": "Do not plan an in-place conversion to the direct shared gallery preview", "summary": "Can an existing Azure Compute Gallery be switched to direct subscription or tenant sharing?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:30:30+00:00", "modified_at": "2026-09-10T00:35:08+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 259, "potentially_affected": "Publishers evaluating direct shared galleries in supported non-government Azure clouds under the preview policy.", "dse_recommendation": "Approve both the new gallery requirement and its broad target audience before adopting direct sharing.", "primary_source": { "name": "Share Azure Compute Gallery Resources Directly with Subscriptions and Tenants - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/share-gallery-direct", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

The direct shared gallery preview requires a new gallery with sharingProfile.permissions set to Groups; an existing gallery cannot be reused or that property updated. Targeting a subscription or tenant makes image consumption available to all Azure users in that target, not just selected people. The preview excludes VM applications, encrypted image versions, and government clouds. Publishing requires preview registration, while consumption does not require extra preview access. Microsoft Learn.

\n

Applicability

\n

Use this review before treating direct sharing as a small permission edit on an established gallery. Confirm that broad distribution is actually required and inspect the current preview limitations and supported tooling.

\n

DSE recommendation

\n

Approve both the new gallery requirement and its broad target audience before adopting direct sharing. Have the image owner identify which approved images could be published to the new gallery and which consumers are intentionally included. Review the subscription or tenant boundary with the identity owner. If the requirement is access for selected principals, reassess whether this distribution mode matches the requirement before creating another gallery.

\n

Verification

\n

Validate the planned target IDs and new gallery configuration in a controlled trial. Confirm an intended consumer can locate and use the approved image through the supported path, and verify that an untargeted boundary is not included in the sharing configuration. Preserve the publisher-to-consumer mapping with the image identity. Keep the original gallery’s lifecycle separate rather than assuming direct-sharing setup has migrated or retired its consumers.

\n

Official references

\n

Microsoft Learn: Share a gallery with all users in a subscription or tenant preview. Source reviewed September 9, 2026.

", "content_text": "Source facts\nThe direct shared gallery preview requires a new gallery with sharingProfile.permissions set to Groups; an existing gallery cannot be reused or that property updated. Targeting a subscription or tenant makes image consumption available to all Azure users in that target, not just selected people. The preview excludes VM applications, encrypted image versions, and government clouds. Publishing requires preview registration, while consumption does not require extra preview access. Microsoft Learn.\nApplicability\nUse this review before treating direct sharing as a small permission edit on an established gallery. Confirm that broad distribution is actually required and inspect the current preview limitations and supported tooling.\nDSE recommendation\nApprove both the new gallery requirement and its broad target audience before adopting direct sharing. Have the image owner identify which approved images could be published to the new gallery and which consumers are intentionally included. Review the subscription or tenant boundary with the identity owner. If the requirement is access for selected principals, reassess whether this distribution mode matches the requirement before creating another gallery.\nVerification\nValidate the planned target IDs and new gallery configuration in a controlled trial. Confirm an intended consumer can locate and use the approved image through the supported path, and verify that an untargeted boundary is not included in the sharing configuration. Preserve the publisher-to-consumer mapping with the image identity. Keep the original gallery’s lifecycle separate rather than assuming direct-sharing setup has migrated or retired its consumers.\nOfficial references\nMicrosoft Learn: Share a gallery with all users in a subscription or tenant preview. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nThe direct shared gallery preview requires a new gallery with sharingProfile.permissions set to Groups; an existing gallery cannot be reused or that property updated. Targeting a subscription or tenant makes image consumption available to all Azure users in that target, not just selected people. The preview excludes VM applications, encrypted image versions, and government clouds. Publishing requires preview registration, while consumption does not require extra preview access. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/share-gallery-direct).\n\n## Applicability\n\nUse this review before treating direct sharing as a small permission edit on an established gallery. Confirm that broad distribution is actually required and inspect the current preview limitations and supported tooling.\n\n## DSE recommendation\n\nApprove both the new gallery requirement and its broad target audience before adopting direct sharing. Have the image owner identify which approved images could be published to the new gallery and which consumers are intentionally included. Review the subscription or tenant boundary with the identity owner. If the requirement is access for selected principals, reassess whether this distribution mode matches the requirement before creating another gallery.\n\n## Verification\n\nValidate the planned target IDs and new gallery configuration in a controlled trial. Confirm an intended consumer can locate and use the approved image through the supported path, and verify that an untargeted boundary is not included in the sharing configuration. Preserve the publisher-to-consumer mapping with the image identity. Keep the original gallery’s lifecycle separate rather than assuming direct-sharing setup has migrated or retired its consumers.\n\n## Official references\n\n[Microsoft Learn: Share a gallery with all users in a subscription or tenant preview](https://learn.microsoft.com/en-us/azure/virtual-machines/share-gallery-direct). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-086-do-not-plan-an-in-place-conversion-to-the-direct-shared-gallery-preview/", "url": "https://update.dsesecurity.com/updates/dse-20260909-086-do-not-plan-an-in-place-conversion-to-the-direct-shared-gallery-preview/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-086-do-not-plan-an-in-place-conversion-to-the-direct-shared-gallery-preview/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Do not plan an in-place conversion to the direct shared gallery preview", "item": "https://update.dsesecurity.com/updates/dse-20260909-086-do-not-plan-an-in-place-conversion-to-the-direct-shared-gallery-preview/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-086-do-not-plan-an-in-place-conversion-to-the-direct-shared-gallery-preview/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-086-do-not-plan-an-in-place-conversion-to-the-direct-shared-gallery-preview/", "url": "https://update.dsesecurity.com/updates/dse-20260909-086-do-not-plan-an-in-place-conversion-to-the-direct-shared-gallery-preview/", "headline": "Do not plan an in-place conversion to the direct shared gallery preview", "description": "Can an existing Azure Compute Gallery be switched to direct subscription or tenant sharing?", "abstract": "Can an existing Azure Compute Gallery be switched to direct subscription or tenant sharing?", "articleBody": "Source facts\nThe direct shared gallery preview requires a new gallery with sharingProfile.permissions set to Groups; an existing gallery cannot be reused or that property updated. Targeting a subscription or tenant makes image consumption available to all Azure users in that target, not just selected people. The preview excludes VM applications, encrypted image versions, and government clouds. Publishing requires preview registration, while consumption does not require extra preview access. Microsoft Learn.\nApplicability\nUse this review before treating direct sharing as a small permission edit on an established gallery. Confirm that broad distribution is actually required and inspect the current preview limitations and supported tooling.\nDSE recommendation\nApprove both the new gallery requirement and its broad target audience before adopting direct sharing. Have the image owner identify which approved images could be published to the new gallery and which consumers are intentionally included. Review the subscription or tenant boundary with the identity owner. If the requirement is access for selected principals, reassess whether this distribution mode matches the requirement before creating another gallery.\nVerification\nValidate the planned target IDs and new gallery configuration in a controlled trial. Confirm an intended consumer can locate and use the approved image through the supported path, and verify that an untargeted boundary is not included in the sharing configuration. Preserve the publisher-to-consumer mapping with the image identity. Keep the original gallery’s lifecycle separate rather than assuming direct-sharing setup has migrated or retired its consumers.\nOfficial references\nMicrosoft Learn: Share a gallery with all users in a subscription or tenant preview. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:30:30+00:00", "dateModified": "2026-09-10T00:35:08+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-086-do-not-plan-an-in-place-conversion-to-the-direct-shared-gallery-preview/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-086-do-not-plan-an-in-place-conversion-to-the-direct-shared-gallery-preview/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not plan an in-place conversion to the direct shared gallery preview" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 259, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Share Azure Compute Gallery Resources Directly with Subscriptions and Tenants - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/share-gallery-direct" } } ] } }