{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-076-test-overlapping-p2s-identity-matches-against-policy-group-priority/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-076-test-overlapping-p2s-identity-matches-against-policy-group-priority/", "slug": "dse-20260917-076-test-overlapping-p2s-identity-matches-against-policy-group-priority", "url": "https://update.dsesecurity.com/updates/dse-20260917-076-test-overlapping-p2s-identity-matches-against-policy-group-priority/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-076-test-overlapping-p2s-identity-matches-against-policy-group-priority.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-076-test-overlapping-p2s-identity-matches-against-policy-group-priority/" }, "title": "Test overlapping P2S identity matches against policy-group priority", "summary": "Verify both matched and default address-pool assignments.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:44+00:00", "modified_at": "2026-09-17T16:38:45+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 219, "potentially_affected": "Review this behavior when implementing identity-based P2S pool selection. Identify the configured authentication type, matching attributes, policy priorities and default policy. Validate pool eligibility and non-overlap against the complete current source before creating the configuration.", "dse_recommendation": "DSE recommends a small assignment matrix with a single-match user, an authorized user matching multiple groups, and an authorized user matching none.", "primary_source": { "name": "Assign Users IP Addresses from Defined Pools for P2S VPN Connections - Azure portal - Azure VPN Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-groups-create-portal", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s P2S user-group procedure evaluates matching policy groups in priority order and assigns an address from the associated pool. A user who matches none receives an address from the default pool. Policy members describe authentication attributes used for matching, rather than representing individual user records. Microsoft Learn.

\n

Applicability

\n

Review this behavior when implementing identity-based P2S pool selection. Identify the configured authentication type, matching attributes, policy priorities and default policy. Validate pool eligibility and non-overlap against the complete current source before creating the configuration.

\n

DSE recommendation

\n

DSE recommends a small assignment matrix with a single-match user, an authorized user matching multiple groups, and an authorized user matching none. Specify the intended winning policy and pool for each. Review group membership and priority changes together, since the acceptance question is the resulting address assignment. Preserve the previous configuration and responsible owner with the change.

\n

Verification

\n

Connect the approved test identities and record assigned addresses against the matrix. Confirm the default case explicitly. Repeat the multi-match case after a controlled priority change, if that change is part of the plan. Keep authentication success separate from evidence that the expected pool supplied the address, and resolve mismatches before wider rollout.

\n

Official references

\n

Microsoft Learn: Assign Users IP Addresses from Defined Pools for P2S VPN Connections – Azure portal.

", "content_text": "Source facts\nMicrosoft’s P2S user-group procedure evaluates matching policy groups in priority order and assigns an address from the associated pool. A user who matches none receives an address from the default pool. Policy members describe authentication attributes used for matching, rather than representing individual user records. Microsoft Learn.\nApplicability\nReview this behavior when implementing identity-based P2S pool selection. Identify the configured authentication type, matching attributes, policy priorities and default policy. Validate pool eligibility and non-overlap against the complete current source before creating the configuration.\nDSE recommendation\nDSE recommends a small assignment matrix with a single-match user, an authorized user matching multiple groups, and an authorized user matching none. Specify the intended winning policy and pool for each. Review group membership and priority changes together, since the acceptance question is the resulting address assignment. Preserve the previous configuration and responsible owner with the change.\nVerification\nConnect the approved test identities and record assigned addresses against the matrix. Confirm the default case explicitly. Repeat the multi-match case after a controlled priority change, if that change is part of the plan. Keep authentication success separate from evidence that the expected pool supplied the address, and resolve mismatches before wider rollout.\nOfficial references\nMicrosoft Learn: Assign Users IP Addresses from Defined Pools for P2S VPN Connections – Azure portal.", "content_markdown": "## Source facts\n\nMicrosoft’s P2S user-group procedure evaluates matching policy groups in priority order and assigns an address from the associated pool. A user who matches none receives an address from the default pool. Policy members describe authentication attributes used for matching, rather than representing individual user records. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-groups-create-portal).\n\n## Applicability\n\nReview this behavior when implementing identity-based P2S pool selection. Identify the configured authentication type, matching attributes, policy priorities and default policy. Validate pool eligibility and non-overlap against the complete current source before creating the configuration.\n\n## DSE recommendation\n\nDSE recommends a small assignment matrix with a single-match user, an authorized user matching multiple groups, and an authorized user matching none. Specify the intended winning policy and pool for each. Review group membership and priority changes together, since the acceptance question is the resulting address assignment. Preserve the previous configuration and responsible owner with the change.\n\n## Verification\n\nConnect the approved test identities and record assigned addresses against the matrix. Confirm the default case explicitly. Repeat the multi-match case after a controlled priority change, if that change is part of the plan. Keep authentication success separate from evidence that the expected pool supplied the address, and resolve mismatches before wider rollout.\n\n## Official references\n\n[Microsoft Learn: Assign Users IP Addresses from Defined Pools for P2S VPN Connections – Azure portal](https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-groups-create-portal)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-076-test-overlapping-p2s-identity-matches-against-policy-group-priority/", "url": "https://update.dsesecurity.com/updates/dse-20260917-076-test-overlapping-p2s-identity-matches-against-policy-group-priority/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-076-test-overlapping-p2s-identity-matches-against-policy-group-priority/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Test overlapping P2S identity matches against policy-group priority", "item": "https://update.dsesecurity.com/updates/dse-20260917-076-test-overlapping-p2s-identity-matches-against-policy-group-priority/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-076-test-overlapping-p2s-identity-matches-against-policy-group-priority/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-076-test-overlapping-p2s-identity-matches-against-policy-group-priority/", "url": "https://update.dsesecurity.com/updates/dse-20260917-076-test-overlapping-p2s-identity-matches-against-policy-group-priority/", "headline": "Test overlapping P2S identity matches against policy-group priority", "description": "Verify both matched and default address-pool assignments.", "abstract": "Verify both matched and default address-pool assignments.", "articleBody": "Source facts\nMicrosoft’s P2S user-group procedure evaluates matching policy groups in priority order and assigns an address from the associated pool. A user who matches none receives an address from the default pool. Policy members describe authentication attributes used for matching, rather than representing individual user records. Microsoft Learn.\nApplicability\nReview this behavior when implementing identity-based P2S pool selection. Identify the configured authentication type, matching attributes, policy priorities and default policy. Validate pool eligibility and non-overlap against the complete current source before creating the configuration.\nDSE recommendation\nDSE recommends a small assignment matrix with a single-match user, an authorized user matching multiple groups, and an authorized user matching none. Specify the intended winning policy and pool for each. Review group membership and priority changes together, since the acceptance question is the resulting address assignment. Preserve the previous configuration and responsible owner with the change.\nVerification\nConnect the approved test identities and record assigned addresses against the matrix. Confirm the default case explicitly. Repeat the multi-match case after a controlled priority change, if that change is part of the plan. Keep authentication success separate from evidence that the expected pool supplied the address, and resolve mismatches before wider rollout.\nOfficial references\nMicrosoft Learn: Assign Users IP Addresses from Defined Pools for P2S VPN Connections – Azure portal.", "datePublished": "2026-09-17T16:33:44+00:00", "dateModified": "2026-09-17T16:38:45+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-076-test-overlapping-p2s-identity-matches-against-policy-group-priority/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-076-test-overlapping-p2s-identity-matches-against-policy-group-priority/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Test overlapping P2S identity matches against policy-group priority" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 219, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Assign Users IP Addresses from Defined Pools for P2S VPN Connections - Azure portal - Azure VPN Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-user-groups-create-portal" } } ] } }