{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-283-keep-bastion-s-target-selector-aligned-with-the-required-sign-in-method/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-283-keep-bastion-s-target-selector-aligned-with-the-required-sign-in-method/", "slug": "dse-20260909-283-keep-bastion-s-target-selector-aligned-with-the-required-sign-in-method", "url": "https://update.dsesecurity.com/updates/dse-20260909-283-keep-bastion-s-target-selector-aligned-with-the-required-sign-in-method/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-283-keep-bastion-s-target-selector-aligned-with-the-required-sign-in-method.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-283-keep-bastion-s-target-selector-aligned-with-the-required-sign-in-method/" }, "title": "Keep Bastion's target selector aligned with the required sign-in method", "summary": "Switching a native-client connection from VM resource ID to private IP changes the supported authentication and connection options.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:27:13+00:00", "modified_at": "2026-09-10T01:23:49+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 241, "potentially_affected": "Azure Bastion connections from Windows native clients to virtual machines, using Standard SKU or higher.", "dse_recommendation": "Review target identity, authentication and connection options together before replacing a resource-ID target with an IP address.", "primary_source": { "name": "Connect to a VM using Bastion - Windows native client - Azure Bastion | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/bastion/connect-vm-native-client-windows", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Bastion native-client connections require Standard SKU or higher. Microsoft’s Windows native-client guidance permits a VM private-IP target instead of a resource ID, but excludes Microsoft Entra authentication and custom ports and protocols for that IP-based connection.

\n

For Entra-joined Windows VM remote connections, Microsoft also requires a Windows 10-or-later client that is registered, joined or hybrid joined to the VM’s directory; the registered-client case starts with Windows 10 20H1. Microsoft Learn.

\n

Applicability

\n

Identify the local Windows client, target VM, Bastion configuration and intended sign-in method. Use the documented connection combination rather than treating every target selector as interchangeable.

\n

DSE recommendation

\n

DSE recommends keeping the VM resource ID in the approved connection record when Entra authentication is a requirement. Before proposing a private-IP alternative, review its exclusions and obtain approval for any changed authentication approach. Do not silently substitute local credentials to make a failed Entra workflow appear successful. Verify the documented roles and connectivity prerequisites for the selected method separately.

\n

Verification

\n

Test the intended native-client path with an authorized test identity and record the target selector actually used. Confirm which authentication method completed the session and whether the expected destination was reached. If an IP-based path cannot meet the required sign-in policy, record that incompatibility explicitly. Keep the result separate from evidence about browser-based session recording or the safety of a received RDP file.

\n

Official references

\n

Microsoft Learn: Connect to a VM using Bastion – Windows native client. Source retrieved September 9, 2026.

", "content_text": "Source facts\nBastion native-client connections require Standard SKU or higher. Microsoft’s Windows native-client guidance permits a VM private-IP target instead of a resource ID, but excludes Microsoft Entra authentication and custom ports and protocols for that IP-based connection.\nFor Entra-joined Windows VM remote connections, Microsoft also requires a Windows 10-or-later client that is registered, joined or hybrid joined to the VM’s directory; the registered-client case starts with Windows 10 20H1. Microsoft Learn.\nApplicability\nIdentify the local Windows client, target VM, Bastion configuration and intended sign-in method. Use the documented connection combination rather than treating every target selector as interchangeable.\nDSE recommendation\nDSE recommends keeping the VM resource ID in the approved connection record when Entra authentication is a requirement. Before proposing a private-IP alternative, review its exclusions and obtain approval for any changed authentication approach. Do not silently substitute local credentials to make a failed Entra workflow appear successful. Verify the documented roles and connectivity prerequisites for the selected method separately.\nVerification\nTest the intended native-client path with an authorized test identity and record the target selector actually used. Confirm which authentication method completed the session and whether the expected destination was reached. If an IP-based path cannot meet the required sign-in policy, record that incompatibility explicitly. Keep the result separate from evidence about browser-based session recording or the safety of a received RDP file.\nOfficial references\nMicrosoft Learn: Connect to a VM using Bastion – Windows native client. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nBastion native-client connections require Standard SKU or higher. Microsoft’s Windows native-client guidance permits a VM private-IP target instead of a resource ID, but excludes Microsoft Entra authentication and custom ports and protocols for that IP-based connection.\n\nFor Entra-joined Windows VM remote connections, Microsoft also requires a Windows 10-or-later client that is registered, joined or hybrid joined to the VM’s directory; the registered-client case starts with Windows 10 20H1. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/bastion/connect-vm-native-client-windows).\n\n## Applicability\n\nIdentify the local Windows client, target VM, Bastion configuration and intended sign-in method. Use the documented connection combination rather than treating every target selector as interchangeable.\n\n## DSE recommendation\n\nDSE recommends keeping the VM resource ID in the approved connection record when Entra authentication is a requirement. Before proposing a private-IP alternative, review its exclusions and obtain approval for any changed authentication approach. Do not silently substitute local credentials to make a failed Entra workflow appear successful. Verify the documented roles and connectivity prerequisites for the selected method separately.\n\n## Verification\n\nTest the intended native-client path with an authorized test identity and record the target selector actually used. Confirm which authentication method completed the session and whether the expected destination was reached. If an IP-based path cannot meet the required sign-in policy, record that incompatibility explicitly. Keep the result separate from evidence about browser-based session recording or the safety of a received RDP file.\n\n## Official references\n\n[Microsoft Learn: Connect to a VM using Bastion – Windows native client](https://learn.microsoft.com/en-us/azure/bastion/connect-vm-native-client-windows). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-283-keep-bastion-s-target-selector-aligned-with-the-required-sign-in-method/", "url": "https://update.dsesecurity.com/updates/dse-20260909-283-keep-bastion-s-target-selector-aligned-with-the-required-sign-in-method/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-283-keep-bastion-s-target-selector-aligned-with-the-required-sign-in-method/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep Bastion's target selector aligned with the required sign-in method", "item": "https://update.dsesecurity.com/updates/dse-20260909-283-keep-bastion-s-target-selector-aligned-with-the-required-sign-in-method/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-283-keep-bastion-s-target-selector-aligned-with-the-required-sign-in-method/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-283-keep-bastion-s-target-selector-aligned-with-the-required-sign-in-method/", "url": "https://update.dsesecurity.com/updates/dse-20260909-283-keep-bastion-s-target-selector-aligned-with-the-required-sign-in-method/", "headline": "Keep Bastion's target selector aligned with the required sign-in method", "description": "Switching a native-client connection from VM resource ID to private IP changes the supported authentication and connection options.", "abstract": "Switching a native-client connection from VM resource ID to private IP changes the supported authentication and connection options.", "articleBody": "Source facts\nBastion native-client connections require Standard SKU or higher. Microsoft’s Windows native-client guidance permits a VM private-IP target instead of a resource ID, but excludes Microsoft Entra authentication and custom ports and protocols for that IP-based connection.\nFor Entra-joined Windows VM remote connections, Microsoft also requires a Windows 10-or-later client that is registered, joined or hybrid joined to the VM’s directory; the registered-client case starts with Windows 10 20H1. Microsoft Learn.\nApplicability\nIdentify the local Windows client, target VM, Bastion configuration and intended sign-in method. Use the documented connection combination rather than treating every target selector as interchangeable.\nDSE recommendation\nDSE recommends keeping the VM resource ID in the approved connection record when Entra authentication is a requirement. Before proposing a private-IP alternative, review its exclusions and obtain approval for any changed authentication approach. Do not silently substitute local credentials to make a failed Entra workflow appear successful. Verify the documented roles and connectivity prerequisites for the selected method separately.\nVerification\nTest the intended native-client path with an authorized test identity and record the target selector actually used. Confirm which authentication method completed the session and whether the expected destination was reached. If an IP-based path cannot meet the required sign-in policy, record that incompatibility explicitly. Keep the result separate from evidence about browser-based session recording or the safety of a received RDP file.\nOfficial references\nMicrosoft Learn: Connect to a VM using Bastion – Windows native client. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:27:13+00:00", "dateModified": "2026-09-10T01:23:49+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-283-keep-bastion-s-target-selector-aligned-with-the-required-sign-in-method/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-283-keep-bastion-s-target-selector-aligned-with-the-required-sign-in-method/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep Bastion's target selector aligned with the required sign-in method" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 241, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Connect to a VM using Bastion - Windows native client - Azure Bastion | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/bastion/connect-vm-native-client-windows" } } ] } }