Test overlapping P2S identity matches against policy-group priority

Source facts

Microsoft’s P2S user-group procedure evaluates matching policy groups in priority order and assigns an address from the associated pool. A user who matches none receives an address from the default pool. Policy members describe authentication attributes used for matching, rather than representing individual user records. Microsoft Learn.

Applicability

Review this behavior when implementing identity-based P2S pool selection. Identify the configured authentication type, matching attributes, policy priorities and default policy. Validate pool eligibility and non-overlap against the complete current source before creating the configuration.

DSE recommendation

DSE recommends a small assignment matrix with a single-match user, an authorized user matching multiple groups, and an authorized user matching none. Specify the intended winning policy and pool for each. Review group membership and priority changes together, since the acceptance question is the resulting address assignment. Preserve the previous configuration and responsible owner with the change.

Verification

Connect the approved test identities and record assigned addresses against the matrix. Confirm the default case explicitly. Repeat the multi-match case after a controlled priority change, if that change is part of the plan. Keep authentication success separate from evidence that the expected pool supplied the address, and resolve mismatches before wider rollout.

Official references

Microsoft Learn: Assign Users IP Addresses from Defined Pools for P2S VPN Connections – Azure portal.