Will the retirement of Inbound NAT Pools affect the load balancer on our managed domain

Question

Will the retirement of Inbound NAT Pools affect the load balancer on our managed domain

ad@stptrans.com 0

We have a managed domain on Azure and it appears that its load balancer uses an inbound NAT pool for its domain controllers. As inbound NAT pools/v1 NAT rules are being retired, I wonder if our managed domain is affected by the deprecation and if we actively have to migrate the rules, or if this happens automatically. I would appreciate some guidance for our specific scenario beyond the documentation here: https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-nat-pool-migration

Amira Bedhiafi 43,046 Reputation points MVP Volunteer Moderator

2026-05-25T09:49:06.7533333+00:00

Hello !

Thank you for posting on MS Learn Q&A.

In the case of Microsoft Entra Domain Services, the load balancer and its NAT rules are created and managed by the service. The Inbound NAT Pools retirement is primarily for VMSS based NAT pools. Please do not manually modify the managed domain load balancer or NAT rules as this can cause a Domain Services outage.

You can verify the config by exporting the load balancer template and checking whether inboundNatPools contains actual entries. If it is empty and the NAT rules target a backend pool and no migration is required. If you see non empty inboundNatPools on the Domain Services managed load balancer, and you can open a support request rather than changing the rules manually.
Venkatesan S 10,830 Reputation points Microsoft External Staff Moderator

2026-05-25T10:45:14.88+00:00
Hi ******@stptrans.com,

Thanks for reaching out in Microsoft Q&A forum,

Your managed domain is most likely not something you should manually reconfigure yourself if Microsoft created and owns the load balancer resources for it. For Azure-managed domain services, Microsoft typically handles the underlying load balancer setup, so the safest approach is to confirm whether the load balancer is Microsoft-managed before making any changes. If it is managed by Microsoft, the migration is generally expected to be handled through the service’s supported path rather than by customer-side edits. If you own the load balancer directly, then you should plan and execute the migration yourself before the retirement date.The practical step is to check the load balancer configuration and confirm whether it is using the older inbound NAT pool style or the newer NAT rules. That will prevent accidental disruption to domain controller connectivity.

Official documentation:

Migrate from Inbound NAT rules version 1 to version 2

Kindly let us know if the above helps or you need further assistance on this issue.

Please “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
ad@stptrans.com 0 Reputation points

2026-05-25T15:06:28.38+00:00

Hi Amira and Venkatesan, thank you for your replies. I tried opening a support case but was directed to the Q&A. I'll see if I can get around it.

2 answers

Your answer

Amira Bedhiafi 43,046 Reputation points MVP Volunteer Moderator

2026-05-25T09:49:06.7533333+00:00

Hello !

Thank you for posting on MS Learn Q&A.

In the case of Microsoft Entra Domain Services, the load balancer and its NAT rules are created and managed by the service. The Inbound NAT Pools retirement is primarily for VMSS based NAT pools. Please do not manually modify the managed domain load balancer or NAT rules as this can cause a Domain Services outage.

You can verify the config by exporting the load balancer template and checking whether inboundNatPools contains actual entries. If it is empty and the NAT rules target a backend pool and no migration is required. If you see non empty inboundNatPools on the Domain Services managed load balancer, and you can open a support request rather than changing the rules manually.
Venkatesan S 10,830 Reputation points Microsoft External Staff Moderator

2026-05-25T10:45:14.88+00:00

Hi ******@stptrans.com,

Thanks for reaching out in Microsoft Q&A forum,

Your managed domain is most likely not something you should manually reconfigure yourself if Microsoft created and owns the load balancer resources for it. For Azure-managed domain services, Microsoft typically handles the underlying load balancer setup, so the safest approach is to confirm whether the load balancer is Microsoft-managed before making any changes. If it is managed by Microsoft, the migration is generally expected to be handled through the service’s supported path rather than by customer-side edits. If you own the load balancer directly, then you should plan and execute the migration yourself before the retirement date.The practical step is to check the load balancer configuration and confirm whether it is using the older inbound NAT pool style or the newer NAT rules. That will prevent accidental disruption to domain controller connectivity.

Official documentation:

Migrate from Inbound NAT rules version 1 to version 2

Kindly let us know if the above helps or you need further assistance on this issue.

Please “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
ad@stptrans.com 0 Reputation points

2026-05-25T15:06:28.38+00:00

Hi Amira and Venkatesan, thank you for your replies. I tried opening a support case but was directed to the Q&A. I'll see if I can get around it.

Answer 1

Hi ******@stptrans.com,

Since your subscription is under the Azure Developer Plan, the request will initially be handled through the Microsoft Q&A forum. We will review the issue and engage the backend team for further investigation if required.

I'm currently checking with backend team will update you.

Here is the link: https://learn.microsoft.com/en-us/azure/azure-portal/supportability/priority-community-support

Update:

Thank you for your patience while we reviewed this scenario internally with the relevant product groups.

Microsoft is actively working with Azure PaaS services that use Azure Load Balancer to ensure they are not impacted by the retirement of Inbound NAT Rules/Pools v1.

For Azure Managed Domain Services specifically, there is currently no action required from customers regarding the managed load balancers deployed by the service. Any required backend updates or migration activities for service-managed resources are expected to be handled by the Azure Managed Domain Services product team.

If this guidance changes or customer action becomes necessary in the future, the Azure Managed Domain Services team will communicate the required steps accordingly.

However, we would also like to clarify that if you have independently deployed your own Azure Load Balancers within your environment (separate from the managed load balancers created by Azure Managed Domain Services), you would be responsible for reviewing and completing any required migration from Inbound NAT Rules v1 to v2 for those customer-managed resources.

Kindly let us know if the above helps or you need further assistance on this issue.

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Venkatesan S 10,830 Reputation points Microsoft External Staff Moderator

2026-05-29T09:20:24.3166667+00:00

Hi ******@stptrans.com,

Just checking in to see if you had a chance to see the previous response posted by me.

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Venkatesan S 10,830 Reputation points Microsoft External Staff Moderator

2026-06-01T16:52:37.3266667+00:00

Hi ******@stptrans.com,

Just checking in to see if you had a chance to see the previous response posted by me.

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

hi ******@stptrans.com & thanks for join me here at Q&A portal,

if this is a Microsoft managed domain, for example Microsoft Entra Domain Services, u normally should not migrate those load balancer NAT rules yourself. Customer-owned Load Balancer inbound NAT pool retirement applies to load balancers u manage directly. Managed service infrastructure should be handled by Microsoft, unless Microsoft explicitly tells u there is customer action.

The migration doc is for customer-managed Load Balancer inbound NAT pools and v1 inbound NAT rules pretty clear and nice https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-nat-pool-migration

If the load balancer is inside a managed resource group or tied to a managed domain service, dont edit NAT rules manually. Those resources can be part of the service control plane, and changing them can break domain controller access. If the portal email or Advisor recommendation points to a resource u own directly, then u need to migrate. If it points to Microsoft-managed infrastructure, open support and ask them to confirm whether the managed domain service will be migrated automatically.

Copy the load balancer resource ID from the retirement notice, check who owns it, and confirm whether it is in ur normal resource group or a managed service resource group. If u can edit it like a normal load balancer, it may be customer-managed. If it belongs to the managed domain deployment, raise a support case under Microsoft Entra Domain Services and Load Balancer retirement.

Do not migrate those NAT pools blindly. For managed domain controllers, Microsoft should confirm the path.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal