{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-085-review-bastion-s-subnet-size-before-planning-host-scaling/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-085-review-bastion-s-subnet-size-before-planning-host-scaling/", "slug": "dse-20260917-085-review-bastion-s-subnet-size-before-planning-host-scaling", "url": "https://update.dsesecurity.com/updates/dse-20260917-085-review-bastion-s-subnet-size-before-planning-host-scaling/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-085-review-bastion-s-subnet-size-before-planning-host-scaling.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-085-review-bastion-s-subnet-size-before-planning-host-scaling/" }, "title": "Review Bastion's subnet size before planning host scaling", "summary": "Do not infer expansion readiness from an older Bastion deployment that still works.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:35+00:00", "modified_at": "2026-09-17T16:38:45+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 211, "potentially_affected": "Use this review for an existing Bastion capacity proposal. Confirm the actual deployment date, subnet prefix, SKU and planned number of sessions or instances. Apply the guide's SKU-specific conditions rather than assuming the Developer offering follows the dedicated-subnet pattern.", "dse_recommendation": "DSE recommends checking the address plan before committing to a scaling change.", "primary_source": { "name": "About Azure Bastion configuration settings | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/bastion/configuration-settings", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft requires Azure Bastion resources deployed on or after November 2, 2021 to use a subnet of /26 or larger. Earlier /27 deployments can continue operating, but Microsoft recommends expanding them when planning for host scaling. Its configuration guide distinguishes Basic’s two instances from the configurable instance count available with Standard or higher. Microsoft Learn.

\n

Applicability

\n

Use this review for an existing Bastion capacity proposal. Confirm the actual deployment date, subnet prefix, SKU and planned number of sessions or instances. Apply the guide’s SKU-specific conditions rather than assuming the Developer offering follows the dedicated-subnet pattern.

\n

DSE recommendation

\n

DSE recommends checking the address plan before committing to a scaling change. Ask the network owner to document whether subnet expansion is feasible and which neighboring ranges constrain it. Separate continued operation of the existing deployment from approval of future capacity. Preserve the current resource configuration and use a change plan appropriate to the actual subnet work.

\n

Verification

\n

Compare the proposed deployment with the documented subnet and scaling requirements. In an approved environment, confirm the requested instance configuration and representative remote sessions. Retain the final subnet prefix and SKU in the capacity record. A successful session through the old deployment should not substitute for that design check.

\n

Official references

\n

Microsoft Learn: About Azure Bastion configuration settings.

", "content_text": "Source facts\nMicrosoft requires Azure Bastion resources deployed on or after November 2, 2021 to use a subnet of /26 or larger. Earlier /27 deployments can continue operating, but Microsoft recommends expanding them when planning for host scaling. Its configuration guide distinguishes Basic’s two instances from the configurable instance count available with Standard or higher. Microsoft Learn.\nApplicability\nUse this review for an existing Bastion capacity proposal. Confirm the actual deployment date, subnet prefix, SKU and planned number of sessions or instances. Apply the guide’s SKU-specific conditions rather than assuming the Developer offering follows the dedicated-subnet pattern.\nDSE recommendation\nDSE recommends checking the address plan before committing to a scaling change. Ask the network owner to document whether subnet expansion is feasible and which neighboring ranges constrain it. Separate continued operation of the existing deployment from approval of future capacity. Preserve the current resource configuration and use a change plan appropriate to the actual subnet work.\nVerification\nCompare the proposed deployment with the documented subnet and scaling requirements. In an approved environment, confirm the requested instance configuration and representative remote sessions. Retain the final subnet prefix and SKU in the capacity record. A successful session through the old deployment should not substitute for that design check.\nOfficial references\nMicrosoft Learn: About Azure Bastion configuration settings.", "content_markdown": "## Source facts\n\nMicrosoft requires Azure Bastion resources deployed on or after November 2, 2021 to use a subnet of /26 or larger. Earlier /27 deployments can continue operating, but Microsoft recommends expanding them when planning for host scaling. Its configuration guide distinguishes Basic’s two instances from the configurable instance count available with Standard or higher. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/bastion/configuration-settings).\n\n## Applicability\n\nUse this review for an existing Bastion capacity proposal. Confirm the actual deployment date, subnet prefix, SKU and planned number of sessions or instances. Apply the guide’s SKU-specific conditions rather than assuming the Developer offering follows the dedicated-subnet pattern.\n\n## DSE recommendation\n\nDSE recommends checking the address plan before committing to a scaling change. Ask the network owner to document whether subnet expansion is feasible and which neighboring ranges constrain it. Separate continued operation of the existing deployment from approval of future capacity. Preserve the current resource configuration and use a change plan appropriate to the actual subnet work.\n\n## Verification\n\nCompare the proposed deployment with the documented subnet and scaling requirements. In an approved environment, confirm the requested instance configuration and representative remote sessions. Retain the final subnet prefix and SKU in the capacity record. A successful session through the old deployment should not substitute for that design check.\n\n## Official references\n\n[Microsoft Learn: About Azure Bastion configuration settings](https://learn.microsoft.com/en-us/azure/bastion/configuration-settings)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-085-review-bastion-s-subnet-size-before-planning-host-scaling/", "url": "https://update.dsesecurity.com/updates/dse-20260917-085-review-bastion-s-subnet-size-before-planning-host-scaling/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-085-review-bastion-s-subnet-size-before-planning-host-scaling/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Review Bastion's subnet size before planning host scaling", "item": "https://update.dsesecurity.com/updates/dse-20260917-085-review-bastion-s-subnet-size-before-planning-host-scaling/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-085-review-bastion-s-subnet-size-before-planning-host-scaling/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-085-review-bastion-s-subnet-size-before-planning-host-scaling/", "url": "https://update.dsesecurity.com/updates/dse-20260917-085-review-bastion-s-subnet-size-before-planning-host-scaling/", "headline": "Review Bastion's subnet size before planning host scaling", "description": "Do not infer expansion readiness from an older Bastion deployment that still works.", "abstract": "Do not infer expansion readiness from an older Bastion deployment that still works.", "articleBody": "Source facts\nMicrosoft requires Azure Bastion resources deployed on or after November 2, 2021 to use a subnet of /26 or larger. Earlier /27 deployments can continue operating, but Microsoft recommends expanding them when planning for host scaling. Its configuration guide distinguishes Basic’s two instances from the configurable instance count available with Standard or higher. Microsoft Learn.\nApplicability\nUse this review for an existing Bastion capacity proposal. Confirm the actual deployment date, subnet prefix, SKU and planned number of sessions or instances. Apply the guide’s SKU-specific conditions rather than assuming the Developer offering follows the dedicated-subnet pattern.\nDSE recommendation\nDSE recommends checking the address plan before committing to a scaling change. Ask the network owner to document whether subnet expansion is feasible and which neighboring ranges constrain it. Separate continued operation of the existing deployment from approval of future capacity. Preserve the current resource configuration and use a change plan appropriate to the actual subnet work.\nVerification\nCompare the proposed deployment with the documented subnet and scaling requirements. In an approved environment, confirm the requested instance configuration and representative remote sessions. Retain the final subnet prefix and SKU in the capacity record. A successful session through the old deployment should not substitute for that design check.\nOfficial references\nMicrosoft Learn: About Azure Bastion configuration settings.", "datePublished": "2026-09-17T16:33:35+00:00", "dateModified": "2026-09-17T16:38:45+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-085-review-bastion-s-subnet-size-before-planning-host-scaling/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-085-review-bastion-s-subnet-size-before-planning-host-scaling/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Review Bastion's subnet size before planning host scaling" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 211, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "About Azure Bastion configuration settings | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/bastion/configuration-settings" } } ] } }