Skip to content

VM/VMSS support add-proxy-agent-extension parameter #32154

Closed

Description

Preconditions

Need Python SDK release 2025-04-01. ETA: 09/30

Related command

az vm create
az vm update
az vmss create
az vmss update

Resource Provider

Microsoft.Compute/VirtualMachines

Description of Feature or Work Requested

PM doc: https://microsoft.sharepoint.com/:w:/r/teams/CPlat-PM/_layouts/15/Doc.aspx?sourcedoc=%7BDD02825F-7D23-4C67-B21C-6352733A8858%7D&file=Wire-Server%20Endpoint%20Security%20PM%20Spec.docx&action=default&mobileredirect=true&share=IQFfggLdI31nTLIcY1JzOohYAV82cMdRnCluKCTcaCyt91E

User can opt-in the Azure metadata security protocol for their VM by specifying the newly introduced VM or VMSS property, thus their VM can be protected from SSRF and Scorpin heart attack to IMDS and WireServer endpoints.

This particular request is to add a new add-proxy-agent-extension parameter that user can opt-in together with -enable-proxy-agent for Linux Provisioning purpose. Please see details in this request: #32124

Minimum API Version Required

2025-04-01

Swagger PR link / SDK link

Azure/azure-rest-api-specs#36669

Request Example

Please see details and how to test in this request: #32124

Target Date

2025-11-02

PM Contact

minnielahoti@microsoft.com

Engineer Contact

huiya@microsoft.com

Additional context

No response

Activity

  1. yonzhan commented on Sep 22, 2025

    @yonzhan
    Collaborator

    Thank you for opening this issue, we will look into it.

  2. added
    Azure CLI TeamThe command of the issue is owned by Azure CLI team
    questionThe issue doesn't require a change to the product in order to be resolved. Most issues start as that
    on Sep 22, 2025
  3. github-actions commented on Sep 22, 2025

    @github-actions

    Here are some similar issues that might help you. Please check if they can solve your problem.


    Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

    Solution 1:

    Please test with a Linux image:

    set resourceGroupName="huiya-eastus2euap"
    set locationName="WestUS2"
    set vmName="vm2"
    set adminPassword="your password"
    az login
    az vm create -g %resourceGroupName% --location %locationName% --image Canonical:0001-com-ubuntu-server-jammy:22_04-lts:latest --size Standard_D2s_v5 --admin-username test_admin --admin-password %adminPassword% --enable-proxy-agent --add-proxy-agent-extension --name %vmName%
    

    Without setting add-proxy-agent-extension, the creation will fail with: :[{"code":"OSProvisioningInternalError","message":"OS Provisioning failed for VM 'vm2' due to an internal error."}]
    With setting add-proxy-agent-extension, the creation will succeed.

    Reference:

    Solution 2:

    The Swagger PR has been merged, and the official Python SDK will be released by the SDK team around 03/28/2025. Please work on top of that release.

    Reference:

    Powered by issue-sentinel

  4. github-actions commented on Sep 22, 2025

    @github-actions

    This issue is related to security. Please pay attention.

    Powered by issue-sentinel

  5. changed the title [-]VM/VMSS support add-proxy-agent-extension parameter #32124[/-] [+]VM/VMSS support add-proxy-agent-extension parameter[/+] on Sep 22, 2025
  6. removed
    questionThe issue doesn't require a change to the product in order to be resolved. Most issues start as that
    on Sep 22, 2025
  7. added this to the Backlog milestone on Sep 22, 2025
  8. zhoxing-ms commented on Sep 23, 2025

    @zhoxing-ms
    Contributor

    Huimin Yan (@huiminyan2017) We will schedule this feature request for the next sprint, and its release time is 11-04

  9. naga-nandyala commented on Oct 26, 2025

    @naga-nandyala
    Contributor

    Hi Huimin Yan (@huiminyan2017)

    Due to other high-priority items, we were unable to complete the build and required testing before the code cutoff date.
    We plan to postpone this feature to the next sprint (2025-11-18).

    Please let us know if that works.

    Thanks

  10. huiminyan2017 commented on Nov 4, 2025

    @huiminyan2017
    Author

    Hi @huiminyan2017

    Due to other high-priority items, we were unable to complete the build and required testing before the code cutoff date. We plan to postpone this feature to the next sprint (2025-11-18).

    Please let us know if that works.

    Thanks

    Can you confirm it will release at 2025-11-18? This feature is already GA-ed and we need to get the support as soon as possible.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Type

No type

Projects

No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions