{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-225-choose-one-msp-configuration-representation-for-each-metadata-service/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-225-choose-one-msp-configuration-representation-for-each-metadata-service/", "slug": "dse-20260909-225-choose-one-msp-configuration-representation-for-each-metadata-service", "url": "https://update.dsesecurity.com/updates/dse-20260909-225-choose-one-msp-configuration-representation-for-each-metadata-service/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-225-choose-one-msp-configuration-representation-for-each-metadata-service.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-225-choose-one-msp-configuration-representation-for-each-metadata-service/" }, "title": "Choose one MSP configuration representation for each metadata service", "summary": "Can an MSP metadata endpoint use an inline mode and a linked access-control profile together?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:11+00:00", "modified_at": "2026-09-10T01:20:46+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 233, "potentially_affected": "Owners configuring Metadata Security Protocol on a supported Azure VM or scale set.", "dse_recommendation": "Choose either inline mode or a linked profile separately for each metadata service.", "primary_source": { "name": "MSP Feature Configuration - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/metadata-security-protocol/configuration", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

MSP configuration requires API version 2024-03-01 or later. For an individual metadata service, an inline mode and a linked access-control profile are mutually exclusive. Inline configuration does not provide customization; linked profiles do. Audit mode forwards requests while logging the authorization result, whereas Enforce mode rejects unauthorized callers and requires signed requests at the service. Microsoft Learn.

\n

Applicability

\n

Review the effective configuration for each endpoint, not just the presence of the VM’s MSP enabled flag. This is a configuration-shape and enforcement-state check for an otherwise supported workload, not a substitute for platform compatibility review.

\n

DSE recommendation

\n

Choose either inline mode or a linked profile separately for each metadata service. Maintain a clear mapping from each endpoint to its chosen representation, profile version where applicable, and intended behavior. Before changing that choice, have the deployment owner inspect the complete desired resource model for stale properties left by a previous configuration. Preserve the intended observation stage and the later enforcement decision as separate change records.

\n

Verification

\n

Check the submitted resource configuration and the resulting settings together. In a controlled test, compare an authorized request with an intentionally unauthorized request and inspect the associated local audit evidence. Do not interpret an audit entry as proof that the request was blocked. Resolve any mismatch between the declared mode and observed behavior before expanding deployment.

\n

Official references

\n

Microsoft Learn: MSP feature configuration. Source reviewed September 9, 2026.

", "content_text": "Source facts\nMSP configuration requires API version 2024-03-01 or later. For an individual metadata service, an inline mode and a linked access-control profile are mutually exclusive. Inline configuration does not provide customization; linked profiles do. Audit mode forwards requests while logging the authorization result, whereas Enforce mode rejects unauthorized callers and requires signed requests at the service. Microsoft Learn.\nApplicability\nReview the effective configuration for each endpoint, not just the presence of the VM’s MSP enabled flag. This is a configuration-shape and enforcement-state check for an otherwise supported workload, not a substitute for platform compatibility review.\nDSE recommendation\nChoose either inline mode or a linked profile separately for each metadata service. Maintain a clear mapping from each endpoint to its chosen representation, profile version where applicable, and intended behavior. Before changing that choice, have the deployment owner inspect the complete desired resource model for stale properties left by a previous configuration. Preserve the intended observation stage and the later enforcement decision as separate change records.\nVerification\nCheck the submitted resource configuration and the resulting settings together. In a controlled test, compare an authorized request with an intentionally unauthorized request and inspect the associated local audit evidence. Do not interpret an audit entry as proof that the request was blocked. Resolve any mismatch between the declared mode and observed behavior before expanding deployment.\nOfficial references\nMicrosoft Learn: MSP feature configuration. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nMSP configuration requires API version 2024-03-01 or later. For an individual metadata service, an inline mode and a linked access-control profile are mutually exclusive. Inline configuration does not provide customization; linked profiles do. Audit mode forwards requests while logging the authorization result, whereas Enforce mode rejects unauthorized callers and requires signed requests at the service. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/metadata-security-protocol/configuration).\n\n## Applicability\n\nReview the effective configuration for each endpoint, not just the presence of the VM’s MSP enabled flag. This is a configuration-shape and enforcement-state check for an otherwise supported workload, not a substitute for platform compatibility review.\n\n## DSE recommendation\n\nChoose either inline mode or a linked profile separately for each metadata service. Maintain a clear mapping from each endpoint to its chosen representation, profile version where applicable, and intended behavior. Before changing that choice, have the deployment owner inspect the complete desired resource model for stale properties left by a previous configuration. Preserve the intended observation stage and the later enforcement decision as separate change records.\n\n## Verification\n\nCheck the submitted resource configuration and the resulting settings together. In a controlled test, compare an authorized request with an intentionally unauthorized request and inspect the associated local audit evidence. Do not interpret an audit entry as proof that the request was blocked. Resolve any mismatch between the declared mode and observed behavior before expanding deployment.\n\n## Official references\n\n[Microsoft Learn: MSP feature configuration](https://learn.microsoft.com/en-us/azure/virtual-machines/metadata-security-protocol/configuration). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-225-choose-one-msp-configuration-representation-for-each-metadata-service/", "url": "https://update.dsesecurity.com/updates/dse-20260909-225-choose-one-msp-configuration-representation-for-each-metadata-service/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-225-choose-one-msp-configuration-representation-for-each-metadata-service/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Choose one MSP configuration representation for each metadata service", "item": "https://update.dsesecurity.com/updates/dse-20260909-225-choose-one-msp-configuration-representation-for-each-metadata-service/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-225-choose-one-msp-configuration-representation-for-each-metadata-service/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-225-choose-one-msp-configuration-representation-for-each-metadata-service/", "url": "https://update.dsesecurity.com/updates/dse-20260909-225-choose-one-msp-configuration-representation-for-each-metadata-service/", "headline": "Choose one MSP configuration representation for each metadata service", "description": "Can an MSP metadata endpoint use an inline mode and a linked access-control profile together?", "abstract": "Can an MSP metadata endpoint use an inline mode and a linked access-control profile together?", "articleBody": "Source facts\nMSP configuration requires API version 2024-03-01 or later. For an individual metadata service, an inline mode and a linked access-control profile are mutually exclusive. Inline configuration does not provide customization; linked profiles do. Audit mode forwards requests while logging the authorization result, whereas Enforce mode rejects unauthorized callers and requires signed requests at the service. Microsoft Learn.\nApplicability\nReview the effective configuration for each endpoint, not just the presence of the VM’s MSP enabled flag. This is a configuration-shape and enforcement-state check for an otherwise supported workload, not a substitute for platform compatibility review.\nDSE recommendation\nChoose either inline mode or a linked profile separately for each metadata service. Maintain a clear mapping from each endpoint to its chosen representation, profile version where applicable, and intended behavior. Before changing that choice, have the deployment owner inspect the complete desired resource model for stale properties left by a previous configuration. Preserve the intended observation stage and the later enforcement decision as separate change records.\nVerification\nCheck the submitted resource configuration and the resulting settings together. In a controlled test, compare an authorized request with an intentionally unauthorized request and inspect the associated local audit evidence. Do not interpret an audit entry as proof that the request was blocked. Resolve any mismatch between the declared mode and observed behavior before expanding deployment.\nOfficial references\nMicrosoft Learn: MSP feature configuration. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:28:11+00:00", "dateModified": "2026-09-10T01:20:46+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-225-choose-one-msp-configuration-representation-for-each-metadata-service/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-225-choose-one-msp-configuration-representation-for-each-metadata-service/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose one MSP configuration representation for each metadata service" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 233, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "MSP Feature Configuration - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/metadata-security-protocol/configuration" } } ] } }