# Map a tenant virtual gateway to its routing subnet and gateway pool

> Which tenant and routing references must be checked when adding an SDN virtual gateway?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260908-118-map-a-tenant-virtual-gateway-to-its-routing-subnet-and-gateway-pool/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-08T18:15:13+00:00
- Modified: 2026-09-08T18:23:27+00:00
- Last reviewed by DSE: 2026-09-08
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Which tenant and routing references must be checked when adding an SDN virtual gateway?

## Potentially affected

Administrators adding site-to-site connectivity to SDN tenant virtual networks.

## DSE recommendation

Have the tenant and network owners review one diagram showing the gateway, subnet, peer, and route ownership.

## Article

## Source facts

A tenant virtual gateway contains network connections such as site-to-site VPN tunnels and may include BGP connections. It links the tenant network with an external network. Microsoft’s procedure first verifies the routing subnet in Network Controller. The new gateway object references both a gateway pool and the subnet used between the gateway and tenant network before the object is added for that tenant. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Add-a-Virtual-Gateway-to-a-Tenant-Virtual-Network).

## Applicability

Identify the tenant, external peer, virtual network, routing subnet, gateway pool, and approved connection parameters. Replace every example value with an explicitly reviewed value for the intended deployment.

## DSE recommendation

Have the tenant and network owners review one diagram showing the gateway, subnet, peer, and route ownership. Record which references belong to that tenant and which infrastructure is shared. Define the expected reachable prefixes and the routes that must remain unavailable.

## Verification

After approved provisioning, inspect the gateway object’s tenant and subnet references and test the agreed traffic paths. Check routing or tunnel state appropriate to the selected connection type. Include a test of an excluded destination and preserve unexpected reachability as a finding before accepting the connection.

## Official references

[Microsoft Learn: Add a Virtual Gateway to a Tenant Virtual Network](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Add-a-Virtual-Gateway-to-a-Tenant-Virtual-Network). Source reviewed September 8, 2026.

## Primary reference

- Name: Add a Virtual Gateway to a Tenant Virtual Network
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/Add-a-Virtual-Gateway-to-a-Tenant-Virtual-Network
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Map a tenant virtual gateway to its routing subnet and gateway pool,” DSE Security, https://update.dsesecurity.com/updates/dse-20260908-118-map-a-tenant-virtual-gateway-to-its-routing-subnet-and-gateway-pool/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.