{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-408-apply-zone-balance-before-interpreting-oldest-or-newest-scale-in-selection/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-408-apply-zone-balance-before-interpreting-oldest-or-newest-scale-in-selection/", "slug": "dse-20260909-408-apply-zone-balance-before-interpreting-oldest-or-newest-scale-in-selection", "url": "https://update.dsesecurity.com/updates/dse-20260909-408-apply-zone-balance-before-interpreting-oldest-or-newest-scale-in-selection/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-408-apply-zone-balance-before-interpreting-oldest-or-newest-scale-in-selection.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-408-apply-zone-balance-before-interpreting-oldest-or-newest-scale-in-selection/" }, "title": "Apply zone balance before interpreting oldest or newest scale-in selection", "summary": "Why can an OldestVM scale-in policy leave the globally oldest instance running?", "format": { "slug": "explainer", "name": "Explainer" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:25:08+00:00", "modified_at": "2026-09-10T02:04:57+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 235, "potentially_affected": "Azure scale sets using OldestVM or NewestVM scale-in policies, particularly zone-spanning deployments.", "dse_recommendation": "Predict scale-in candidates from zone balance and protection first, then apply the configured age rule within that eligible population.", "primary_source": { "name": "Use scale-in policies with Azure Virtual Machine Scale Sets - Azure Virtual Machine Scale Sets | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-scale-in-policy", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For a zone-spanning scale set, OldestVM and NewestVM selection follows zone balancing rather than a global age sort alone. When zones are uneven, the age rule operates within the imbalanced zones. Balancing deletes instances; it does not relocate them between zones or fault domains. Instance protection excludes a VM from scale-in regardless of the policy, but does not prevent an explicit user deletion. Microsoft Learn.

\n

Applicability

\n

Investigate an unexpected age-based selection using the distribution that existed immediately before the scale-in. Identify the policy and protection state of the candidate instances. Keep this question separate from deciding when autoscale should request a smaller population.

\n

DSE recommendation

\n

Predict scale-in candidates from zone balance and protection first, then apply the configured age rule within that eligible population. Have the application owner check whether important per-instance work is tied to an assumed global deletion order. Do not remove protection merely to make the observed order resemble a spreadsheet sorted by creation time.

\n

Verification

\n

On an approved disposable deployment, capture instance creation times, zones, and protection before a bounded scale-in. Compare the actual removal with the documented selection order. Repeat the reasoning after the population changes rather than reusing the old candidate list. If the result is inconsistent, retain the complete pre-operation inventory and operation evidence for investigation instead of deleting the expected instance manually to conceal the discrepancy.

\n

Official references

\n

Microsoft Learn: Scale-in policies. Source reviewed September 9, 2026.

", "content_text": "Source facts\nFor a zone-spanning scale set, OldestVM and NewestVM selection follows zone balancing rather than a global age sort alone. When zones are uneven, the age rule operates within the imbalanced zones. Balancing deletes instances; it does not relocate them between zones or fault domains. Instance protection excludes a VM from scale-in regardless of the policy, but does not prevent an explicit user deletion. Microsoft Learn.\nApplicability\nInvestigate an unexpected age-based selection using the distribution that existed immediately before the scale-in. Identify the policy and protection state of the candidate instances. Keep this question separate from deciding when autoscale should request a smaller population.\nDSE recommendation\nPredict scale-in candidates from zone balance and protection first, then apply the configured age rule within that eligible population. Have the application owner check whether important per-instance work is tied to an assumed global deletion order. Do not remove protection merely to make the observed order resemble a spreadsheet sorted by creation time.\nVerification\nOn an approved disposable deployment, capture instance creation times, zones, and protection before a bounded scale-in. Compare the actual removal with the documented selection order. Repeat the reasoning after the population changes rather than reusing the old candidate list. If the result is inconsistent, retain the complete pre-operation inventory and operation evidence for investigation instead of deleting the expected instance manually to conceal the discrepancy.\nOfficial references\nMicrosoft Learn: Scale-in policies. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nFor a zone-spanning scale set, OldestVM and NewestVM selection follows zone balancing rather than a global age sort alone. When zones are uneven, the age rule operates within the imbalanced zones. Balancing deletes instances; it does not relocate them between zones or fault domains. Instance protection excludes a VM from scale-in regardless of the policy, but does not prevent an explicit user deletion. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-scale-in-policy).\n\n## Applicability\n\nInvestigate an unexpected age-based selection using the distribution that existed immediately before the scale-in. Identify the policy and protection state of the candidate instances. Keep this question separate from deciding when autoscale should request a smaller population.\n\n## DSE recommendation\n\nPredict scale-in candidates from zone balance and protection first, then apply the configured age rule within that eligible population. Have the application owner check whether important per-instance work is tied to an assumed global deletion order. Do not remove protection merely to make the observed order resemble a spreadsheet sorted by creation time.\n\n## Verification\n\nOn an approved disposable deployment, capture instance creation times, zones, and protection before a bounded scale-in. Compare the actual removal with the documented selection order. Repeat the reasoning after the population changes rather than reusing the old candidate list. If the result is inconsistent, retain the complete pre-operation inventory and operation evidence for investigation instead of deleting the expected instance manually to conceal the discrepancy.\n\n## Official references\n\n[Microsoft Learn: Scale-in policies](https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-scale-in-policy). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-408-apply-zone-balance-before-interpreting-oldest-or-newest-scale-in-selection/", "url": "https://update.dsesecurity.com/updates/dse-20260909-408-apply-zone-balance-before-interpreting-oldest-or-newest-scale-in-selection/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-408-apply-zone-balance-before-interpreting-oldest-or-newest-scale-in-selection/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Apply zone balance before interpreting oldest or newest scale-in selection", "item": "https://update.dsesecurity.com/updates/dse-20260909-408-apply-zone-balance-before-interpreting-oldest-or-newest-scale-in-selection/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-408-apply-zone-balance-before-interpreting-oldest-or-newest-scale-in-selection/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-408-apply-zone-balance-before-interpreting-oldest-or-newest-scale-in-selection/", "url": "https://update.dsesecurity.com/updates/dse-20260909-408-apply-zone-balance-before-interpreting-oldest-or-newest-scale-in-selection/", "headline": "Apply zone balance before interpreting oldest or newest scale-in selection", "description": "Why can an OldestVM scale-in policy leave the globally oldest instance running?", "abstract": "Why can an OldestVM scale-in policy leave the globally oldest instance running?", "articleBody": "Source facts\nFor a zone-spanning scale set, OldestVM and NewestVM selection follows zone balancing rather than a global age sort alone. When zones are uneven, the age rule operates within the imbalanced zones. Balancing deletes instances; it does not relocate them between zones or fault domains. Instance protection excludes a VM from scale-in regardless of the policy, but does not prevent an explicit user deletion. Microsoft Learn.\nApplicability\nInvestigate an unexpected age-based selection using the distribution that existed immediately before the scale-in. Identify the policy and protection state of the candidate instances. Keep this question separate from deciding when autoscale should request a smaller population.\nDSE recommendation\nPredict scale-in candidates from zone balance and protection first, then apply the configured age rule within that eligible population. Have the application owner check whether important per-instance work is tied to an assumed global deletion order. Do not remove protection merely to make the observed order resemble a spreadsheet sorted by creation time.\nVerification\nOn an approved disposable deployment, capture instance creation times, zones, and protection before a bounded scale-in. Compare the actual removal with the documented selection order. Repeat the reasoning after the population changes rather than reusing the old candidate list. If the result is inconsistent, retain the complete pre-operation inventory and operation evidence for investigation instead of deleting the expected instance manually to conceal the discrepancy.\nOfficial references\nMicrosoft Learn: Scale-in policies. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:25:08+00:00", "dateModified": "2026-09-10T02:04:57+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-408-apply-zone-balance-before-interpreting-oldest-or-newest-scale-in-selection/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-408-apply-zone-balance-before-interpreting-oldest-or-newest-scale-in-selection/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Apply zone balance before interpreting oldest or newest scale-in selection" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Explainer", "Information priority" ], "genre": "Explainer", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 235, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Use scale-in policies with Azure Virtual Machine Scale Sets - Azure Virtual Machine Scale Sets | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-scale-in-policy" } } ] } }