{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-577-identify-vm-scale-set-nat-pools-before-adding-every-v1-nat-rule-to-a-retirement/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-577-identify-vm-scale-set-nat-pools-before-adding-every-v1-nat-rule-to-a-retirement/", "slug": "dse-20260909-577-identify-vm-scale-set-nat-pools-before-adding-every-v1-nat-rule-to-a-retirement", "url": "https://update.dsesecurity.com/updates/dse-20260909-577-identify-vm-scale-set-nat-pools-before-adding-every-v1-nat-rule-to-a-retirement/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-577-identify-vm-scale-set-nat-pools-before-adding-every-v1-nat-rule-to-a-retirement.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-577-identify-vm-scale-set-nat-pools-before-adding-every-v1-nat-rule-to-a-retirement/" }, "title": "Identify VM scale-set NAT Pools before adding every V1 NAT rule to a retirement plan", "summary": "The September 2027 retirement applies to Inbound NAT Pools, not single-VM V1 inbound NAT rules.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:22:19+00:00", "modified_at": "2026-09-10T02:14:31+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 227, "potentially_affected": "Azure Load Balancer inventories containing V1 single-VM rules or VM scale-set Inbound NAT Pools.", "dse_recommendation": "Classify the actual resource properties before scheduling a NAT migration.", "primary_source": { "name": "Migrate from Inbound NAT rules version 1 to version 2 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-nat-pool-migration", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft schedules Inbound NAT Pools, the VM scale-set-specific V1 feature, for retirement on September 30, 2027. Single-VM V1 inbound NAT rules are outside that retirement and do not require migration because of it.

\n

NAT Pools appear in inboundNatPools, while inbound NAT rules appear in inboundNatRules. A nonempty pool array identifies the affected feature. Migration interrupts active NAT-rule traffic, although load-balancing-rule and outbound-rule traffic are not affected by that migration process. Microsoft Learn.

\n

Applicability

\n

Inspect the actual load balancer and associated scale-set configuration. Do not classify the entire population from the V1 label alone or mistake a single-VM port mapping for a scale-set pool.

\n

DSE recommendation

\n

DSE recommends building the retirement worklist from nonempty pool configurations and recording excluded single-VM cases separately. For affected deployments, plan supported upgrade prerequisites, frontend-port capacity and a maintenance window using the complete migration guide. Avoid unnecessary changes to unaffected rules merely to make every object use the same version label.

\n

Verification

\n

Before scheduling, confirm each work item contains the affected pool property and the expected scale-set association. After an approved migration, verify pools are absent, the new rule targets the intended backend pool and expected per-instance port mappings work. Retain the classification evidence for unaffected resources so later inventory reviews do not repeatedly reopen unnecessary migration work.

\n

Official references

\n

Microsoft Learn: Migrate from Inbound NAT rules version 1 to version 2. Source retrieved September 9, 2026.

", "content_text": "Source facts\nMicrosoft schedules Inbound NAT Pools, the VM scale-set-specific V1 feature, for retirement on September 30, 2027. Single-VM V1 inbound NAT rules are outside that retirement and do not require migration because of it.\nNAT Pools appear in inboundNatPools, while inbound NAT rules appear in inboundNatRules. A nonempty pool array identifies the affected feature. Migration interrupts active NAT-rule traffic, although load-balancing-rule and outbound-rule traffic are not affected by that migration process. Microsoft Learn.\nApplicability\nInspect the actual load balancer and associated scale-set configuration. Do not classify the entire population from the V1 label alone or mistake a single-VM port mapping for a scale-set pool.\nDSE recommendation\nDSE recommends building the retirement worklist from nonempty pool configurations and recording excluded single-VM cases separately. For affected deployments, plan supported upgrade prerequisites, frontend-port capacity and a maintenance window using the complete migration guide. Avoid unnecessary changes to unaffected rules merely to make every object use the same version label.\nVerification\nBefore scheduling, confirm each work item contains the affected pool property and the expected scale-set association. After an approved migration, verify pools are absent, the new rule targets the intended backend pool and expected per-instance port mappings work. Retain the classification evidence for unaffected resources so later inventory reviews do not repeatedly reopen unnecessary migration work.\nOfficial references\nMicrosoft Learn: Migrate from Inbound NAT rules version 1 to version 2. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nMicrosoft schedules Inbound NAT Pools, the VM scale-set-specific V1 feature, for retirement on September 30, 2027. Single-VM V1 inbound NAT rules are outside that retirement and do not require migration because of it.\n\nNAT Pools appear in inboundNatPools, while inbound NAT rules appear in inboundNatRules. A nonempty pool array identifies the affected feature. Migration interrupts active NAT-rule traffic, although load-balancing-rule and outbound-rule traffic are not affected by that migration process. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-nat-pool-migration).\n\n## Applicability\n\nInspect the actual load balancer and associated scale-set configuration. Do not classify the entire population from the V1 label alone or mistake a single-VM port mapping for a scale-set pool.\n\n## DSE recommendation\n\nDSE recommends building the retirement worklist from nonempty pool configurations and recording excluded single-VM cases separately. For affected deployments, plan supported upgrade prerequisites, frontend-port capacity and a maintenance window using the complete migration guide. Avoid unnecessary changes to unaffected rules merely to make every object use the same version label.\n\n## Verification\n\nBefore scheduling, confirm each work item contains the affected pool property and the expected scale-set association. After an approved migration, verify pools are absent, the new rule targets the intended backend pool and expected per-instance port mappings work. Retain the classification evidence for unaffected resources so later inventory reviews do not repeatedly reopen unnecessary migration work.\n\n## Official references\n\n[Microsoft Learn: Migrate from Inbound NAT rules version 1 to version 2](https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-nat-pool-migration). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-577-identify-vm-scale-set-nat-pools-before-adding-every-v1-nat-rule-to-a-retirement/", "url": "https://update.dsesecurity.com/updates/dse-20260909-577-identify-vm-scale-set-nat-pools-before-adding-every-v1-nat-rule-to-a-retirement/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-577-identify-vm-scale-set-nat-pools-before-adding-every-v1-nat-rule-to-a-retirement/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Identify VM scale-set NAT Pools before adding every V1 NAT rule to a retirement plan", "item": "https://update.dsesecurity.com/updates/dse-20260909-577-identify-vm-scale-set-nat-pools-before-adding-every-v1-nat-rule-to-a-retirement/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-577-identify-vm-scale-set-nat-pools-before-adding-every-v1-nat-rule-to-a-retirement/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-577-identify-vm-scale-set-nat-pools-before-adding-every-v1-nat-rule-to-a-retirement/", "url": "https://update.dsesecurity.com/updates/dse-20260909-577-identify-vm-scale-set-nat-pools-before-adding-every-v1-nat-rule-to-a-retirement/", "headline": "Identify VM scale-set NAT Pools before adding every V1 NAT rule to a retirement plan", "description": "The September 2027 retirement applies to Inbound NAT Pools, not single-VM V1 inbound NAT rules.", "abstract": "The September 2027 retirement applies to Inbound NAT Pools, not single-VM V1 inbound NAT rules.", "articleBody": "Source facts\nMicrosoft schedules Inbound NAT Pools, the VM scale-set-specific V1 feature, for retirement on September 30, 2027. Single-VM V1 inbound NAT rules are outside that retirement and do not require migration because of it.\nNAT Pools appear in inboundNatPools, while inbound NAT rules appear in inboundNatRules. A nonempty pool array identifies the affected feature. Migration interrupts active NAT-rule traffic, although load-balancing-rule and outbound-rule traffic are not affected by that migration process. Microsoft Learn.\nApplicability\nInspect the actual load balancer and associated scale-set configuration. Do not classify the entire population from the V1 label alone or mistake a single-VM port mapping for a scale-set pool.\nDSE recommendation\nDSE recommends building the retirement worklist from nonempty pool configurations and recording excluded single-VM cases separately. For affected deployments, plan supported upgrade prerequisites, frontend-port capacity and a maintenance window using the complete migration guide. Avoid unnecessary changes to unaffected rules merely to make every object use the same version label.\nVerification\nBefore scheduling, confirm each work item contains the affected pool property and the expected scale-set association. After an approved migration, verify pools are absent, the new rule targets the intended backend pool and expected per-instance port mappings work. Retain the classification evidence for unaffected resources so later inventory reviews do not repeatedly reopen unnecessary migration work.\nOfficial references\nMicrosoft Learn: Migrate from Inbound NAT rules version 1 to version 2. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:22:19+00:00", "dateModified": "2026-09-10T02:14:31+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-577-identify-vm-scale-set-nat-pools-before-adding-every-v1-nat-rule-to-a-retirement/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-577-identify-vm-scale-set-nat-pools-before-adding-every-v1-nat-rule-to-a-retirement/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Identify VM scale-set NAT Pools before adding every V1 NAT rule to a retirement plan" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 227, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Migrate from Inbound NAT rules version 1 to version 2 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-nat-pool-migration" } } ] } }