Azure VM extensions
What it is
Azure VM extensions are small applications Azure installs into a VM’s guest operating system to perform post-deployment configuration or automation. Examples include running a script, installing a monitoring agent, configuring security tooling, or collecting diagnostics.
Why it exists
Instead of signing in to every VM to do the same setup, a team can declare an extension in the VM or scale set model and have Azure manage its installation. This makes a repeatable setup possible through the portal, CLI, or infrastructure-as-code template.
Key ideas
- Custom Script Extension runs a command or script in the guest OS. It is useful for a bounded setup task, such as installing the order-service package.
- The VM Guest Agent is the delivery path. Most extensions require an appropriate guest agent and extension-specific prerequisites such as a supported OS or access to a download endpoint.
- Extensions vary by purpose. Examples include Azure Monitor, VM access, antimalware, disk encryption, and diagnostics extensions. Check the individual extension’s support and behavior instead of assuming every extension works on every image.
- Treat scripts as production code. Store them in source control, make them safe to rerun where possible, log their results, and avoid embedding secrets. Use a managed identity and Key Vault when a workload must retrieve a secret.
- Extensions are not a universal configuration-management platform. Use them for well-defined guest tasks and choose a suitable desired-state or image/IaC strategy for ongoing configuration needs.
Northwind example
Northwind deploys a new set of web VMs from a known image. A Custom Script Extension installs the current web package and registers the service with the local OS. The script checks whether that version is already installed, so a redeployment does not break a healthy VM. It reads the required database endpoint from a non-secret configuration source and uses the VM’s managed identity to retrieve any necessary secret at runtime; it does not place credentials in the extension command.
How it fits (diagram)
Exam notes
- Custom Script Extension performs a declared guest-OS task after VM deployment; write the script to tolerate reruns.
- The guest agent and extension prerequisites must be healthy and reachable.
- Use extension output and VM health information to troubleshoot failure; do not assume an ARM deployment success means guest configuration succeeded.
Related
Path MOC · azure-vm · azure-cli · arm-template · virtual-machine-scale-set
📘 Source: Microsoft Learn — Azure VM extensions and features