{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-352-plan-bastion-kerberos-dns-changes-as-a-redeployment-dependency/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-352-plan-bastion-kerberos-dns-changes-as-a-redeployment-dependency/",
        "slug": "dse-20260909-352-plan-bastion-kerberos-dns-changes-as-a-redeployment-dependency",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-352-plan-bastion-kerberos-dns-changes-as-a-redeployment-dependency/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-352-plan-bastion-kerberos-dns-changes-as-a-redeployment-dependency.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-352-plan-bastion-kerberos-dns-changes-as-a-redeployment-dependency/"
        },
        "title": "Plan Bastion Kerberos DNS changes as a redeployment dependency",
        "summary": "Microsoft warns that changed DNS server information does not propagate to an existing Bastion resource.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:26:04+00:00",
        "modified_at": "2026-09-10T02:01:55+00:00",
        "reviewed_on": "2026-09-09",
        "reading_minutes": 1,
        "word_count": 212,
        "potentially_affected": "Azure Bastion Kerberos configurations using the Azure portal and supported Azure-hosted domain controllers.",
        "dse_recommendation": "Include Bastion redeployment and an independently usable access path in the DNS change plan.",
        "primary_source": {
            "name": "Configure Bastion for Kerberos authentication - Azure portal - Azure Bastion | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/bastion/kerberos-authentication-portal",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft states that DNS server changes do not propagate to Bastion and require deleting and recreating the Bastion resource. Its Kerberos configuration guidance requires an Azure-hosted domain-controller VM in the same virtual network as Bastion.</p>\n<p>This Kerberos configuration uses the portal, not the native client, and requires Basic SKU or higher. Cross-realm authentication and VMs migrated from on-premises are not supported in the documented considerations. <a href=\"https://learn.microsoft.com/en-us/azure/bastion/kerberos-authentication-portal\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Review the actual domain-controller location, virtual network, Bastion SKU and connection method. This is change planning for a documented dependency, not an instruction to delete a production access resource immediately.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends identifying this redeployment dependency before approving DNS-server changes. Preserve reviewed configuration, define an independently authorized administration path and agree on an access-restoration test. Coordinate the Bastion and directory owners rather than extending a propagation wait indefinitely. Keep unsupported authentication topologies out of the proposed acceptance plan.</p>\n<h2>Verification</h2>\n<p>After an approved redeployment, test the intended domain-joined target through the portal and verify the actual authentication method. A successful session alone should not be substituted for the requested Kerberos evidence. Document the DNS configuration, recreated resource identity and controlled test results before closing the change.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/bastion/kerberos-authentication-portal\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Configure Bastion for Kerberos authentication &#8211; Azure portal</a>. Source retrieved September 9, 2026.</p>",
        "content_text": "Source facts\nMicrosoft states that DNS server changes do not propagate to Bastion and require deleting and recreating the Bastion resource. Its Kerberos configuration guidance requires an Azure-hosted domain-controller VM in the same virtual network as Bastion.\nThis Kerberos configuration uses the portal, not the native client, and requires Basic SKU or higher. Cross-realm authentication and VMs migrated from on-premises are not supported in the documented considerations. Microsoft Learn.\nApplicability\nReview the actual domain-controller location, virtual network, Bastion SKU and connection method. This is change planning for a documented dependency, not an instruction to delete a production access resource immediately.\nDSE recommendation\nDSE recommends identifying this redeployment dependency before approving DNS-server changes. Preserve reviewed configuration, define an independently authorized administration path and agree on an access-restoration test. Coordinate the Bastion and directory owners rather than extending a propagation wait indefinitely. Keep unsupported authentication topologies out of the proposed acceptance plan.\nVerification\nAfter an approved redeployment, test the intended domain-joined target through the portal and verify the actual authentication method. A successful session alone should not be substituted for the requested Kerberos evidence. Document the DNS configuration, recreated resource identity and controlled test results before closing the change.\nOfficial references\nMicrosoft Learn: Configure Bastion for Kerberos authentication – Azure portal. Source retrieved September 9, 2026.",
        "content_markdown": "## Source facts\n\nMicrosoft states that DNS server changes do not propagate to Bastion and require deleting and recreating the Bastion resource. Its Kerberos configuration guidance requires an Azure-hosted domain-controller VM in the same virtual network as Bastion.\n\nThis Kerberos configuration uses the portal, not the native client, and requires Basic SKU or higher. Cross-realm authentication and VMs migrated from on-premises are not supported in the documented considerations. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/bastion/kerberos-authentication-portal).\n\n## Applicability\n\nReview the actual domain-controller location, virtual network, Bastion SKU and connection method. This is change planning for a documented dependency, not an instruction to delete a production access resource immediately.\n\n## DSE recommendation\n\nDSE recommends identifying this redeployment dependency before approving DNS-server changes. Preserve reviewed configuration, define an independently authorized administration path and agree on an access-restoration test. Coordinate the Bastion and directory owners rather than extending a propagation wait indefinitely. Keep unsupported authentication topologies out of the proposed acceptance plan.\n\n## Verification\n\nAfter an approved redeployment, test the intended domain-joined target through the portal and verify the actual authentication method. A successful session alone should not be substituted for the requested Kerberos evidence. Document the DNS configuration, recreated resource identity and controlled test results before closing the change.\n\n## Official references\n\n[Microsoft Learn: Configure Bastion for Kerberos authentication – Azure portal](https://learn.microsoft.com/en-us/azure/bastion/kerberos-authentication-portal). Source retrieved September 9, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-352-plan-bastion-kerberos-dns-changes-as-a-redeployment-dependency/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-352-plan-bastion-kerberos-dns-changes-as-a-redeployment-dependency/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-09"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-352-plan-bastion-kerberos-dns-changes-as-a-redeployment-dependency/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Plan Bastion Kerberos DNS changes as a redeployment dependency",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-352-plan-bastion-kerberos-dns-changes-as-a-redeployment-dependency/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-352-plan-bastion-kerberos-dns-changes-as-a-redeployment-dependency/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-352-plan-bastion-kerberos-dns-changes-as-a-redeployment-dependency/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-352-plan-bastion-kerberos-dns-changes-as-a-redeployment-dependency/",
                "headline": "Plan Bastion Kerberos DNS changes as a redeployment dependency",
                "description": "Microsoft warns that changed DNS server information does not propagate to an existing Bastion resource.",
                "abstract": "Microsoft warns that changed DNS server information does not propagate to an existing Bastion resource.",
                "articleBody": "Source facts\nMicrosoft states that DNS server changes do not propagate to Bastion and require deleting and recreating the Bastion resource. Its Kerberos configuration guidance requires an Azure-hosted domain-controller VM in the same virtual network as Bastion.\nThis Kerberos configuration uses the portal, not the native client, and requires Basic SKU or higher. Cross-realm authentication and VMs migrated from on-premises are not supported in the documented considerations. Microsoft Learn.\nApplicability\nReview the actual domain-controller location, virtual network, Bastion SKU and connection method. This is change planning for a documented dependency, not an instruction to delete a production access resource immediately.\nDSE recommendation\nDSE recommends identifying this redeployment dependency before approving DNS-server changes. Preserve reviewed configuration, define an independently authorized administration path and agree on an access-restoration test. Coordinate the Bastion and directory owners rather than extending a propagation wait indefinitely. Keep unsupported authentication topologies out of the proposed acceptance plan.\nVerification\nAfter an approved redeployment, test the intended domain-joined target through the portal and verify the actual authentication method. A successful session alone should not be substituted for the requested Kerberos evidence. Document the DNS configuration, recreated resource identity and controlled test results before closing the change.\nOfficial references\nMicrosoft Learn: Configure Bastion for Kerberos authentication – Azure portal. Source retrieved September 9, 2026.",
                "datePublished": "2026-09-10T00:26:04+00:00",
                "dateModified": "2026-09-10T02:01:55+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-352-plan-bastion-kerberos-dns-changes-as-a-redeployment-dependency/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-352-plan-bastion-kerberos-dns-changes-as-a-redeployment-dependency/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Plan Bastion Kerberos DNS changes as a redeployment dependency"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 212,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Configure Bastion for Kerberos authentication - Azure portal - Azure Bastion | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/bastion/kerberos-authentication-portal"
                }
            }
        ]
    }
}