VM/VMSS support add-proxy-agent-extension parameter

[huiminyan2017]

Preconditions

Need Python SDK release 2025-04-01. ETA: 09/30

Related command

az vm create
az vm update
az vmss create
az vmss update

Resource Provider

Microsoft.Compute/VirtualMachines

Description of Feature or Work Requested

PM doc: https://microsoft.sharepoint.com/:w:/r/teams/CPlat-PM/_layouts/15/Doc.aspx?sourcedoc=%7BDD02825F-7D23-4C67-B21C-6352733A8858%7D&file=Wire-Server%20Endpoint%20Security%20PM%20Spec.docx&action=default&mobileredirect=true&share=IQFfggLdI31nTLIcY1JzOohYAV82cMdRnCluKCTcaCyt91E

User can opt-in the Azure metadata security protocol for their VM by specifying the newly introduced VM or VMSS property, thus their VM can be protected from SSRF and Scorpin heart attack to IMDS and WireServer endpoints.

This particular request is to add a new add-proxy-agent-extension parameter that user can opt-in together with -enable-proxy-agent for Linux Provisioning purpose. Please see details in this request: #32124

Minimum API Version Required

2025-04-01

Swagger PR link / SDK link

Azure/azure-rest-api-specs#36669

Request Example

Please see details and how to test in this request: #32124

Target Date

2025-11-02

PM Contact

minnielahoti@microsoft.com

Engineer Contact

huiya@microsoft.com

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• VM/VMSS to support Azure Metadata Security Protocol #27729
• VM/VMSS support add-proxy-agent-extension parameter #32124
• VM/VMSS to support v2 Version of Azure Metadata Security Protocol #29279

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

Please test with a Linux image:

set resourceGroupName="huiya-eastus2euap"
set locationName="WestUS2"
set vmName="vm2"
set adminPassword="your password"
az login
az vm create -g %resourceGroupName% --location %locationName% --image Canonical:0001-com-ubuntu-server-jammy:22_04-lts:latest --size Standard_D2s_v5 --admin-username test_admin --admin-password %adminPassword% --enable-proxy-agent --add-proxy-agent-extension --name %vmName%

Without setting add-proxy-agent-extension, the creation will fail with: :[{"code":"OSProvisioningInternalError","message":"OS Provisioning failed for VM 'vm2' due to an internal error."}]
With setting add-proxy-agent-extension, the creation will succeed.

Reference:

• VM/VMSS support add-proxy-agent-extension parameter #32124 (comment)

Solution 2:

The Swagger PR has been merged, and the official Python SDK will be released by the SDK team around 03/28/2025. Please work on top of that release.

Reference:

• VM/VMSS to support v2 Version of Azure Metadata Security Protocol #29279 (comment)

Powered by issue-sentinel

[github-actions]

This issue is related to security. Please pay attention.

Powered by issue-sentinel