{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-073-keep-msp-key-reset-counters-increasing-across-recovery-automation/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-073-keep-msp-key-reset-counters-increasing-across-recovery-automation/", "slug": "dse-20260909-073-keep-msp-key-reset-counters-increasing-across-recovery-automation", "url": "https://update.dsesecurity.com/updates/dse-20260909-073-keep-msp-key-reset-counters-increasing-across-recovery-automation/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-073-keep-msp-key-reset-counters-increasing-across-recovery-automation.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-073-keep-msp-key-reset-counters-increasing-across-recovery-automation/" }, "title": "Keep MSP key-reset counters increasing across recovery automation", "summary": "What must repeated MSP key-reset requests preserve when more than one recovery attempt updates the VM?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:30:43+00:00", "modified_at": "2026-09-10T00:35:07+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 240, "potentially_affected": "Operators recovering a lost or rejected Metadata Security Protocol long-lived key on a supported Azure VM.", "dse_recommendation": "Coordinate key-reset writers and record the existing counter before submitting the next value.", "primary_source": { "name": "Troubleshoot MSP - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/metadata-security-protocol/troubleshoot-guide", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

When an MSP VM loses its long-lived key, it cannot communicate with Instance Metadata Service or WireServer, and Azure cannot safely issue a replacement automatically. Microsoft documents resetting the key through KeyIncarnationId in the VM model. Repeated or automated requests must use strictly increasing values; otherwise the change might not apply. After the reset, the Guest Proxy Agent periodically retries recovery and acquires the replacement key. Microsoft Learn.

\n

Applicability

\n

Use this procedure only after diagnosing a key-acquisition problem through the documented agent status and logs. Keep it distinct from an eBPF, cgroup, or unsupported-image problem, which has a different recovery path in the source.

\n

DSE recommendation

\n

Coordinate key-reset writers and record the existing counter before submitting the next value. Have one recovery owner control the sequence so a retry or parallel automation job does not send a stale value. Preserve the reason for the reset and the approved VM identity without recording the long-lived secret itself. Do not recycle a hard-coded counter in a reusable recovery template.

\n

Verification

\n

Inspect the resulting VM-model value and then observe the agent’s status as it attempts recovery. Confirm the intended metadata-dependent operation works again, using a controlled request that does not expose credentials. Keep the accepted counter and sanitized status evidence with the incident. If the model update succeeds but the agent remains unhealthy, investigate the reported component state before issuing another reset.

\n

Official references

\n

Microsoft Learn: Troubleshoot MSP. Source reviewed September 9, 2026.

", "content_text": "Source facts\nWhen an MSP VM loses its long-lived key, it cannot communicate with Instance Metadata Service or WireServer, and Azure cannot safely issue a replacement automatically. Microsoft documents resetting the key through KeyIncarnationId in the VM model. Repeated or automated requests must use strictly increasing values; otherwise the change might not apply. After the reset, the Guest Proxy Agent periodically retries recovery and acquires the replacement key. Microsoft Learn.\nApplicability\nUse this procedure only after diagnosing a key-acquisition problem through the documented agent status and logs. Keep it distinct from an eBPF, cgroup, or unsupported-image problem, which has a different recovery path in the source.\nDSE recommendation\nCoordinate key-reset writers and record the existing counter before submitting the next value. Have one recovery owner control the sequence so a retry or parallel automation job does not send a stale value. Preserve the reason for the reset and the approved VM identity without recording the long-lived secret itself. Do not recycle a hard-coded counter in a reusable recovery template.\nVerification\nInspect the resulting VM-model value and then observe the agent’s status as it attempts recovery. Confirm the intended metadata-dependent operation works again, using a controlled request that does not expose credentials. Keep the accepted counter and sanitized status evidence with the incident. If the model update succeeds but the agent remains unhealthy, investigate the reported component state before issuing another reset.\nOfficial references\nMicrosoft Learn: Troubleshoot MSP. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nWhen an MSP VM loses its long-lived key, it cannot communicate with Instance Metadata Service or WireServer, and Azure cannot safely issue a replacement automatically. Microsoft documents resetting the key through KeyIncarnationId in the VM model. Repeated or automated requests must use strictly increasing values; otherwise the change might not apply. After the reset, the Guest Proxy Agent periodically retries recovery and acquires the replacement key. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/metadata-security-protocol/troubleshoot-guide).\n\n## Applicability\n\nUse this procedure only after diagnosing a key-acquisition problem through the documented agent status and logs. Keep it distinct from an eBPF, cgroup, or unsupported-image problem, which has a different recovery path in the source.\n\n## DSE recommendation\n\nCoordinate key-reset writers and record the existing counter before submitting the next value. Have one recovery owner control the sequence so a retry or parallel automation job does not send a stale value. Preserve the reason for the reset and the approved VM identity without recording the long-lived secret itself. Do not recycle a hard-coded counter in a reusable recovery template.\n\n## Verification\n\nInspect the resulting VM-model value and then observe the agent’s status as it attempts recovery. Confirm the intended metadata-dependent operation works again, using a controlled request that does not expose credentials. Keep the accepted counter and sanitized status evidence with the incident. If the model update succeeds but the agent remains unhealthy, investigate the reported component state before issuing another reset.\n\n## Official references\n\n[Microsoft Learn: Troubleshoot MSP](https://learn.microsoft.com/en-us/azure/virtual-machines/metadata-security-protocol/troubleshoot-guide). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-073-keep-msp-key-reset-counters-increasing-across-recovery-automation/", "url": "https://update.dsesecurity.com/updates/dse-20260909-073-keep-msp-key-reset-counters-increasing-across-recovery-automation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-073-keep-msp-key-reset-counters-increasing-across-recovery-automation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep MSP key-reset counters increasing across recovery automation", "item": "https://update.dsesecurity.com/updates/dse-20260909-073-keep-msp-key-reset-counters-increasing-across-recovery-automation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-073-keep-msp-key-reset-counters-increasing-across-recovery-automation/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-073-keep-msp-key-reset-counters-increasing-across-recovery-automation/", "url": "https://update.dsesecurity.com/updates/dse-20260909-073-keep-msp-key-reset-counters-increasing-across-recovery-automation/", "headline": "Keep MSP key-reset counters increasing across recovery automation", "description": "What must repeated MSP key-reset requests preserve when more than one recovery attempt updates the VM?", "abstract": "What must repeated MSP key-reset requests preserve when more than one recovery attempt updates the VM?", "articleBody": "Source facts\nWhen an MSP VM loses its long-lived key, it cannot communicate with Instance Metadata Service or WireServer, and Azure cannot safely issue a replacement automatically. Microsoft documents resetting the key through KeyIncarnationId in the VM model. Repeated or automated requests must use strictly increasing values; otherwise the change might not apply. After the reset, the Guest Proxy Agent periodically retries recovery and acquires the replacement key. Microsoft Learn.\nApplicability\nUse this procedure only after diagnosing a key-acquisition problem through the documented agent status and logs. Keep it distinct from an eBPF, cgroup, or unsupported-image problem, which has a different recovery path in the source.\nDSE recommendation\nCoordinate key-reset writers and record the existing counter before submitting the next value. Have one recovery owner control the sequence so a retry or parallel automation job does not send a stale value. Preserve the reason for the reset and the approved VM identity without recording the long-lived secret itself. Do not recycle a hard-coded counter in a reusable recovery template.\nVerification\nInspect the resulting VM-model value and then observe the agent’s status as it attempts recovery. Confirm the intended metadata-dependent operation works again, using a controlled request that does not expose credentials. Keep the accepted counter and sanitized status evidence with the incident. If the model update succeeds but the agent remains unhealthy, investigate the reported component state before issuing another reset.\nOfficial references\nMicrosoft Learn: Troubleshoot MSP. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:30:43+00:00", "dateModified": "2026-09-10T00:35:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-073-keep-msp-key-reset-counters-increasing-across-recovery-automation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-073-keep-msp-key-reset-counters-increasing-across-recovery-automation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep MSP key-reset counters increasing across recovery automation" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 240, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Troubleshoot MSP - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/metadata-security-protocol/troubleshoot-guide" } } ] } }