# Review Bastion's subnet size before planning host scaling

> Do not infer expansion readiness from an older Bastion deployment that still works.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-085-review-bastion-s-subnet-size-before-planning-host-scaling/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:35+00:00
- Modified: 2026-09-17T16:38:45+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Do not infer expansion readiness from an older Bastion deployment that still works.

## Potentially affected

Use this review for an existing Bastion capacity proposal. Confirm the actual deployment date, subnet prefix, SKU and planned number of sessions or instances. Apply the guide's SKU-specific conditions rather than assuming the Developer offering follows the dedicated-subnet pattern.

## DSE recommendation

DSE recommends checking the address plan before committing to a scaling change.

## Article

## Source facts

Microsoft requires Azure Bastion resources deployed on or after November 2, 2021 to use a subnet of /26 or larger. Earlier /27 deployments can continue operating, but Microsoft recommends expanding them when planning for host scaling. Its configuration guide distinguishes Basic’s two instances from the configurable instance count available with Standard or higher. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/bastion/configuration-settings).

## Applicability

Use this review for an existing Bastion capacity proposal. Confirm the actual deployment date, subnet prefix, SKU and planned number of sessions or instances. Apply the guide’s SKU-specific conditions rather than assuming the Developer offering follows the dedicated-subnet pattern.

## DSE recommendation

DSE recommends checking the address plan before committing to a scaling change. Ask the network owner to document whether subnet expansion is feasible and which neighboring ranges constrain it. Separate continued operation of the existing deployment from approval of future capacity. Preserve the current resource configuration and use a change plan appropriate to the actual subnet work.

## Verification

Compare the proposed deployment with the documented subnet and scaling requirements. In an approved environment, confirm the requested instance configuration and representative remote sessions. Retain the final subnet prefix and SKU in the capacity record. A successful session through the old deployment should not substitute for that design check.

## Official references

[Microsoft Learn: About Azure Bastion configuration settings](https://learn.microsoft.com/en-us/azure/bastion/configuration-settings).

## Primary reference

- Name: About Azure Bastion configuration settings | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/bastion/configuration-settings
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Review Bastion's subnet size before planning host scaling,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-085-review-bastion-s-subnet-size-before-planning-host-scaling/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.