{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-260-detach-a-vm-before-changing-its-flexible-scale-set-membership/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-260-detach-a-vm-before-changing-its-flexible-scale-set-membership/", "slug": "dse-20260909-260-detach-a-vm-before-changing-its-flexible-scale-set-membership", "url": "https://update.dsesecurity.com/updates/dse-20260909-260-detach-a-vm-before-changing-its-flexible-scale-set-membership/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-260-detach-a-vm-before-changing-its-flexible-scale-set-membership.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-260-detach-a-vm-before-changing-its-flexible-scale-set-membership/" }, "title": "Detach a VM before changing its Flexible scale-set membership", "summary": "How should an existing VM move between eligible Flexible scale sets without treating membership as traffic configuration?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:27:36+00:00", "modified_at": "2026-09-10T01:23:48+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 259, "potentially_affected": "Existing eligible managed-disk VMs moving between Azure Flexible scale sets with one platform fault domain and singlePlacementGroup explicitly false.", "dse_recommendation": "Plan a verified detach followed by attachment, with traffic membership checked independently before and after the move.", "primary_source": { "name": "Attach or detach a virtual machine to or from a Virtual Machine Scale Set - Azure Virtual Machine Scale Sets | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-attach-detach-vm", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft requires detaching a VM before attaching it to another scale set. Clearing the association uses a null value, not an empty string or the text null. Attachment does not change network settings or automatically join a load balancer. Existing-VM attachment requires Flexible orchestration, one platform fault domain, explicit singlePlacementGroup=false, a common resource group, managed disks, and compatible regional or zonal placement. The source excludes availability-set, proximity-placement-group, Dedicated Host, and the specified RDMA-capable HB/N-series cases. Microsoft Learn.

\n

Applicability

\n

Use this workflow for an existing VM that satisfies both detachment and destination-attachment restrictions. Do not use the scale-set ID field as a shortcut around an incompatible placement configuration. Assess the documented preview-related RDMA restrictions explicitly before planning an exceptional hardware case.

\n

DSE recommendation

\n

Plan a verified detach followed by attachment, with traffic membership checked independently before and after the move. Have the network owner identify which load-balancer configuration should remain or change. Record the source set, destination set, and standalone VM identity. Agree what to do if detachment succeeds but attachment is rejected before starting that two-stage operation.

\n

Verification

\n

Inspect the VM’s association after detachment and again after attachment, using the exact intended destination ID. Separately test the application’s intended traffic path and inspect the network interface configuration. Do not accept a successful membership change as proof that requests reach the VM. Preserve any rejected destination constraint and the actual remaining association so the recovery decision starts from observed state.

\n

Official references

\n

Microsoft Learn: Attach or detach a VM from a scale set. Source reviewed September 9, 2026.

", "content_text": "Source facts\nMicrosoft requires detaching a VM before attaching it to another scale set. Clearing the association uses a null value, not an empty string or the text null. Attachment does not change network settings or automatically join a load balancer. Existing-VM attachment requires Flexible orchestration, one platform fault domain, explicit singlePlacementGroup=false, a common resource group, managed disks, and compatible regional or zonal placement. The source excludes availability-set, proximity-placement-group, Dedicated Host, and the specified RDMA-capable HB/N-series cases. Microsoft Learn.\nApplicability\nUse this workflow for an existing VM that satisfies both detachment and destination-attachment restrictions. Do not use the scale-set ID field as a shortcut around an incompatible placement configuration. Assess the documented preview-related RDMA restrictions explicitly before planning an exceptional hardware case.\nDSE recommendation\nPlan a verified detach followed by attachment, with traffic membership checked independently before and after the move. Have the network owner identify which load-balancer configuration should remain or change. Record the source set, destination set, and standalone VM identity. Agree what to do if detachment succeeds but attachment is rejected before starting that two-stage operation.\nVerification\nInspect the VM’s association after detachment and again after attachment, using the exact intended destination ID. Separately test the application’s intended traffic path and inspect the network interface configuration. Do not accept a successful membership change as proof that requests reach the VM. Preserve any rejected destination constraint and the actual remaining association so the recovery decision starts from observed state.\nOfficial references\nMicrosoft Learn: Attach or detach a VM from a scale set. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nMicrosoft requires detaching a VM before attaching it to another scale set. Clearing the association uses a null value, not an empty string or the text null. Attachment does not change network settings or automatically join a load balancer. Existing-VM attachment requires Flexible orchestration, one platform fault domain, explicit singlePlacementGroup=false, a common resource group, managed disks, and compatible regional or zonal placement. The source excludes availability-set, proximity-placement-group, Dedicated Host, and the specified RDMA-capable HB/N-series cases. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-attach-detach-vm).\n\n## Applicability\n\nUse this workflow for an existing VM that satisfies both detachment and destination-attachment restrictions. Do not use the scale-set ID field as a shortcut around an incompatible placement configuration. Assess the documented preview-related RDMA restrictions explicitly before planning an exceptional hardware case.\n\n## DSE recommendation\n\nPlan a verified detach followed by attachment, with traffic membership checked independently before and after the move. Have the network owner identify which load-balancer configuration should remain or change. Record the source set, destination set, and standalone VM identity. Agree what to do if detachment succeeds but attachment is rejected before starting that two-stage operation.\n\n## Verification\n\nInspect the VM’s association after detachment and again after attachment, using the exact intended destination ID. Separately test the application’s intended traffic path and inspect the network interface configuration. Do not accept a successful membership change as proof that requests reach the VM. Preserve any rejected destination constraint and the actual remaining association so the recovery decision starts from observed state.\n\n## Official references\n\n[Microsoft Learn: Attach or detach a VM from a scale set](https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-attach-detach-vm). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-260-detach-a-vm-before-changing-its-flexible-scale-set-membership/", "url": "https://update.dsesecurity.com/updates/dse-20260909-260-detach-a-vm-before-changing-its-flexible-scale-set-membership/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-260-detach-a-vm-before-changing-its-flexible-scale-set-membership/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Detach a VM before changing its Flexible scale-set membership", "item": "https://update.dsesecurity.com/updates/dse-20260909-260-detach-a-vm-before-changing-its-flexible-scale-set-membership/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-260-detach-a-vm-before-changing-its-flexible-scale-set-membership/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-260-detach-a-vm-before-changing-its-flexible-scale-set-membership/", "url": "https://update.dsesecurity.com/updates/dse-20260909-260-detach-a-vm-before-changing-its-flexible-scale-set-membership/", "headline": "Detach a VM before changing its Flexible scale-set membership", "description": "How should an existing VM move between eligible Flexible scale sets without treating membership as traffic configuration?", "abstract": "How should an existing VM move between eligible Flexible scale sets without treating membership as traffic configuration?", "articleBody": "Source facts\nMicrosoft requires detaching a VM before attaching it to another scale set. Clearing the association uses a null value, not an empty string or the text null. Attachment does not change network settings or automatically join a load balancer. Existing-VM attachment requires Flexible orchestration, one platform fault domain, explicit singlePlacementGroup=false, a common resource group, managed disks, and compatible regional or zonal placement. The source excludes availability-set, proximity-placement-group, Dedicated Host, and the specified RDMA-capable HB/N-series cases. Microsoft Learn.\nApplicability\nUse this workflow for an existing VM that satisfies both detachment and destination-attachment restrictions. Do not use the scale-set ID field as a shortcut around an incompatible placement configuration. Assess the documented preview-related RDMA restrictions explicitly before planning an exceptional hardware case.\nDSE recommendation\nPlan a verified detach followed by attachment, with traffic membership checked independently before and after the move. Have the network owner identify which load-balancer configuration should remain or change. Record the source set, destination set, and standalone VM identity. Agree what to do if detachment succeeds but attachment is rejected before starting that two-stage operation.\nVerification\nInspect the VM’s association after detachment and again after attachment, using the exact intended destination ID. Separately test the application’s intended traffic path and inspect the network interface configuration. Do not accept a successful membership change as proof that requests reach the VM. Preserve any rejected destination constraint and the actual remaining association so the recovery decision starts from observed state.\nOfficial references\nMicrosoft Learn: Attach or detach a VM from a scale set. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:27:36+00:00", "dateModified": "2026-09-10T01:23:48+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-260-detach-a-vm-before-changing-its-flexible-scale-set-membership/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-260-detach-a-vm-before-changing-its-flexible-scale-set-membership/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Detach a VM before changing its Flexible scale-set membership" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 259, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Attach or detach a virtual machine to or from a Virtual Machine Scale Set - Azure Virtual Machine Scale Sets | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-attach-detach-vm" } } ] } }