Azure VM extensions
What it is
Azure VM extensions are small packages that run post-deployment automation inside a VM’s guest OS — installing software, running scripts, configuring settings, applying security/antimalware, collecting diagnostics. They are applied after the VM is created (Config drift fix) via the VM agent that runs in the guest.
Why it exists
You can’t easily log into every VM to bootstrap software at scale. Extensions let you execute the same bootstrap/maintenance on one VM or a whole scale set declaratively, reproducibly, and from the control plane (Portal/CLI/templates).
Key ideas
- Custom Script Extension (Windows
CustomScriptExtension, LinuxcustomScriptorCustomScriptForLinux): pass a script (inline or from blob storage) that runs on the guest — the most common way to bootstrap/configure a VM. - VM agent (waagent / WindowsGuestAgent) must be installed for most extensions; most marketplace images include it.
- Other common extensions: Azure Monitor agent (diagnostics), Desired State Configuration (
DSC), Network Watcher agent; DSC for Windows configuration state. - Extensions are defined in the VM/scale set model; Managed identity + Key Vault lets a custom script fetch secrets safely.
How it fits (diagram)
Exam notes
- Run Custom Script Extension at provisioning to avoid manually SSH/RDP-ing into every VM; it’s idempotent-ish — re-running is usually safe but scripts should be written to be idempotent.
- External dependencies (script URL in blob storage) must be accessible; use Key Vault / SAS for secure script retrieval.
- Diagnostics extension (boot diagnostics) helps troubleshoot VM boot issues via serial console.
- AZ-104: Custom Script Extension is the go-to tool to “configure a new VM after creation”.
Related
Path MOC · azure-vm · azure-cli · arm-template · virtual-machine-scale-set
📘 Source: Microsoft Learn — Azure Vm Extension