Design the access path for a dedicated WAC gateway in Azure

Source facts

Microsoft distinguishes deploying a dedicated WAC gateway on an Azure VM for multiple VMs from using the portal experience for one VM. Its deployment script can create the environment, including the resource group. The documented gateway needs HTTPS access on port 443. Microsoft recommends limiting self-signed gateway certificates to test environments. Microsoft Learn.

Applicability

Choose the dedicated-gateway deployment deliberately and identify its intended operators and managed machines. Review the current script parameters, certificate guidance, and network requirements. Keep a gateway VM deployment separate from enabling the portal extension on an individual server.

DSE recommendation

Prepare the resource, certificate, and network-access plan before running a deployment script. Have the Azure owner review every resource the selected parameters may create and the scope of allowed HTTPS clients. Assign an owner for the gateway name and certificate renewal. Use a controlled pilot and retain a documented management alternative while the gateway is being introduced.

Verification

Verify the created resources against the approved plan and connect using the intended DNS name and trusted certificate. Test one authorized managed VM and an unauthorized gateway user. Review the actual network exposure and any unexpected created resource. Accept the gateway only after its management path and operational ownership are clear.

Official references

Microsoft Learn: Deploy a Windows Admin Center gateway in Azure. Source reviewed September 8, 2026.