{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-178-coordinate-proxy-v2-across-shared-private-link-service-backends/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-178-coordinate-proxy-v2-across-shared-private-link-service-backends/", "slug": "dse-20260909-178-coordinate-proxy-v2-across-shared-private-link-service-backends", "url": "https://update.dsesecurity.com/updates/dse-20260909-178-coordinate-proxy-v2-across-shared-private-link-service-backends/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-178-coordinate-proxy-v2-across-shared-private-link-service-backends.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-178-coordinate-proxy-v2-across-shared-private-link-service-backends/" }, "title": "Coordinate PROXY v2 across shared Private Link service backends", "summary": "Review protocol parsing and shared load-balancer dependencies before enabling consumer connection metadata.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:58+00:00", "modified_at": "2026-09-10T00:55:36+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 227, "potentially_affected": "Standard Azure Private Link services sharing load balancers or backend pools.", "dse_recommendation": "Inventory every sharing Private Link service and validate backend PROXY v2 parsing before changing the setting.", "primary_source": { "name": "What is Azure Private Link service? | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/private-link/private-link-service-overview", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Private Link service translates consumer source addresses to provider-side NAT addresses. PROXY v2 can convey the original source and endpoint LinkID, but the backend must parse the added header; a mismatch between the service setting and backend expectation causes requests to fail.

\n

Microsoft warns that enabling PROXY v2 affects shared load-balancer and backend arrangements. Other Private Link services sharing them must be configured consistently, or health probes fail. The header is also included in HTTP/TCP health probes. Microsoft Learn.

\n

Applicability

\n

Use this review for standard load-balancer-backed Private Link services, not the separate Direct Connect preview. Map sharing services and backend consumers before considering the setting a change to only one endpoint.

\n

DSE recommendation

\n

DSE recommends a compatibility change plan agreed by the service and application owners. Record which backends expect the header, which services share their pool, and how connection metadata will be interpreted. Preserve the prior configuration and define a coordinated restoration sequence if parsing or probes fail.

\n

Verification

\n

In a representative test, inspect backend request handling, reported connection metadata, and health probes before and after enabling the protocol. Exercise each sharing service rather than just the first one changed. Confirm requests work and the observed source/LinkID correlation is correct; do not treat that correlation alone as application authorization.

\n

Official references

\n

Microsoft Learn: What is Azure Private Link service?. Source retrieved September 9, 2026.

", "content_text": "Source facts\nPrivate Link service translates consumer source addresses to provider-side NAT addresses. PROXY v2 can convey the original source and endpoint LinkID, but the backend must parse the added header; a mismatch between the service setting and backend expectation causes requests to fail.\nMicrosoft warns that enabling PROXY v2 affects shared load-balancer and backend arrangements. Other Private Link services sharing them must be configured consistently, or health probes fail. The header is also included in HTTP/TCP health probes. Microsoft Learn.\nApplicability\nUse this review for standard load-balancer-backed Private Link services, not the separate Direct Connect preview. Map sharing services and backend consumers before considering the setting a change to only one endpoint.\nDSE recommendation\nDSE recommends a compatibility change plan agreed by the service and application owners. Record which backends expect the header, which services share their pool, and how connection metadata will be interpreted. Preserve the prior configuration and define a coordinated restoration sequence if parsing or probes fail.\nVerification\nIn a representative test, inspect backend request handling, reported connection metadata, and health probes before and after enabling the protocol. Exercise each sharing service rather than just the first one changed. Confirm requests work and the observed source/LinkID correlation is correct; do not treat that correlation alone as application authorization.\nOfficial references\nMicrosoft Learn: What is Azure Private Link service?. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nPrivate Link service translates consumer source addresses to provider-side NAT addresses. PROXY v2 can convey the original source and endpoint LinkID, but the backend must parse the added header; a mismatch between the service setting and backend expectation causes requests to fail.\n\nMicrosoft warns that enabling PROXY v2 affects shared load-balancer and backend arrangements. Other Private Link services sharing them must be configured consistently, or health probes fail. The header is also included in HTTP/TCP health probes. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/private-link/private-link-service-overview).\n\n## Applicability\n\nUse this review for standard load-balancer-backed Private Link services, not the separate Direct Connect preview. Map sharing services and backend consumers before considering the setting a change to only one endpoint.\n\n## DSE recommendation\n\nDSE recommends a compatibility change plan agreed by the service and application owners. Record which backends expect the header, which services share their pool, and how connection metadata will be interpreted. Preserve the prior configuration and define a coordinated restoration sequence if parsing or probes fail.\n\n## Verification\n\nIn a representative test, inspect backend request handling, reported connection metadata, and health probes before and after enabling the protocol. Exercise each sharing service rather than just the first one changed. Confirm requests work and the observed source/LinkID correlation is correct; do not treat that correlation alone as application authorization.\n\n## Official references\n\n[Microsoft Learn: What is Azure Private Link service?](https://learn.microsoft.com/en-us/azure/private-link/private-link-service-overview). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-178-coordinate-proxy-v2-across-shared-private-link-service-backends/", "url": "https://update.dsesecurity.com/updates/dse-20260909-178-coordinate-proxy-v2-across-shared-private-link-service-backends/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-178-coordinate-proxy-v2-across-shared-private-link-service-backends/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Coordinate PROXY v2 across shared Private Link service backends", "item": "https://update.dsesecurity.com/updates/dse-20260909-178-coordinate-proxy-v2-across-shared-private-link-service-backends/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-178-coordinate-proxy-v2-across-shared-private-link-service-backends/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-178-coordinate-proxy-v2-across-shared-private-link-service-backends/", "url": "https://update.dsesecurity.com/updates/dse-20260909-178-coordinate-proxy-v2-across-shared-private-link-service-backends/", "headline": "Coordinate PROXY v2 across shared Private Link service backends", "description": "Review protocol parsing and shared load-balancer dependencies before enabling consumer connection metadata.", "abstract": "Review protocol parsing and shared load-balancer dependencies before enabling consumer connection metadata.", "articleBody": "Source facts\nPrivate Link service translates consumer source addresses to provider-side NAT addresses. PROXY v2 can convey the original source and endpoint LinkID, but the backend must parse the added header; a mismatch between the service setting and backend expectation causes requests to fail.\nMicrosoft warns that enabling PROXY v2 affects shared load-balancer and backend arrangements. Other Private Link services sharing them must be configured consistently, or health probes fail. The header is also included in HTTP/TCP health probes. Microsoft Learn.\nApplicability\nUse this review for standard load-balancer-backed Private Link services, not the separate Direct Connect preview. Map sharing services and backend consumers before considering the setting a change to only one endpoint.\nDSE recommendation\nDSE recommends a compatibility change plan agreed by the service and application owners. Record which backends expect the header, which services share their pool, and how connection metadata will be interpreted. Preserve the prior configuration and define a coordinated restoration sequence if parsing or probes fail.\nVerification\nIn a representative test, inspect backend request handling, reported connection metadata, and health probes before and after enabling the protocol. Exercise each sharing service rather than just the first one changed. Confirm requests work and the observed source/LinkID correlation is correct; do not treat that correlation alone as application authorization.\nOfficial references\nMicrosoft Learn: What is Azure Private Link service?. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:28:58+00:00", "dateModified": "2026-09-10T00:55:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-178-coordinate-proxy-v2-across-shared-private-link-service-backends/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-178-coordinate-proxy-v2-across-shared-private-link-service-backends/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Coordinate PROXY v2 across shared Private Link service backends" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 227, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "What is Azure Private Link service? | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/private-link/private-link-service-overview" } } ] } }