{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-102-attach-the-publishing-identity-to-the-gallery-not-the-destination-vm/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-102-attach-the-publishing-identity-to-the-gallery-not-the-destination-vm/", "slug": "dse-20260909-102-attach-the-publishing-identity-to-the-gallery-not-the-destination-vm", "url": "https://update.dsesecurity.com/updates/dse-20260909-102-attach-the-publishing-identity-to-the-gallery-not-the-destination-vm/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-102-attach-the-publishing-identity-to-the-gallery-not-the-destination-vm.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-102-attach-the-publishing-identity-to-the-gallery-not-the-destination-vm/" }, "title": "Attach the publishing identity to the gallery, not the destination VM", "summary": "Which identity reads a private application blob when an Azure VM Application version is published?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:30:14+00:00", "modified_at": "2026-09-10T00:52:38+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 249, "potentially_affected": "Publishers adopting managed-identity blob access for Azure Compute Gallery VM Application versions.", "dse_recommendation": "Bind the package-reading identity and its storage role to the gallery's publishing workflow.", "primary_source": { "name": "Publish VM applications using managed identity - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications-publish-with-managed-identity", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

The documented VM Application publishing flow attaches a user-assigned identity to Compute Gallery and grants it Storage Blob Data Contributor access to the package’s storage account. Publication uses a plain blob URL rather than a SAS URL. If direct URL access lacks permission, the gallery falls back to its attached identity. This support applies to publishing, not deployment onto VMs or scale sets. Microsoft Learn.

\n

Applicability

\n

Identify the gallery, package blob, storage authorization, and identity used by publication. Keep destination-VM identity and application deployment permissions as separate subjects. Review the source’s trusted-service network behavior and supported management tools against the storage account’s actual restrictions before implementation.

\n

DSE recommendation

\n

Bind the package-reading identity and its storage role to the gallery’s publishing workflow. Have the storage owner review the documented role scope and confirm that the intended identity is attached to the correct gallery. Remove the assumption that granting a role to a destination VM will solve a publication-time blob access problem. Keep authentication evidence free of SAS secrets.

\n

Verification

\n

Publish a benign test package through the approved gallery using its plain blob URL and inspect the actual result. Check identity assignment and storage access when publication fails before broadening anonymous access or generating a replacement SAS. Then verify application deployment separately using its own supported path. Retain the publisher identity, gallery ID, blob identity, and distinct publish/deploy outcomes without conflating the two authorization stages.

\n

Official references

\n

Microsoft Learn: Publish VM Applications using managed identity. Source reviewed September 9, 2026.

", "content_text": "Source facts\nThe documented VM Application publishing flow attaches a user-assigned identity to Compute Gallery and grants it Storage Blob Data Contributor access to the package’s storage account. Publication uses a plain blob URL rather than a SAS URL. If direct URL access lacks permission, the gallery falls back to its attached identity. This support applies to publishing, not deployment onto VMs or scale sets. Microsoft Learn.\nApplicability\nIdentify the gallery, package blob, storage authorization, and identity used by publication. Keep destination-VM identity and application deployment permissions as separate subjects. Review the source’s trusted-service network behavior and supported management tools against the storage account’s actual restrictions before implementation.\nDSE recommendation\nBind the package-reading identity and its storage role to the gallery’s publishing workflow. Have the storage owner review the documented role scope and confirm that the intended identity is attached to the correct gallery. Remove the assumption that granting a role to a destination VM will solve a publication-time blob access problem. Keep authentication evidence free of SAS secrets.\nVerification\nPublish a benign test package through the approved gallery using its plain blob URL and inspect the actual result. Check identity assignment and storage access when publication fails before broadening anonymous access or generating a replacement SAS. Then verify application deployment separately using its own supported path. Retain the publisher identity, gallery ID, blob identity, and distinct publish/deploy outcomes without conflating the two authorization stages.\nOfficial references\nMicrosoft Learn: Publish VM Applications using managed identity. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nThe documented VM Application publishing flow attaches a user-assigned identity to Compute Gallery and grants it Storage Blob Data Contributor access to the package’s storage account. Publication uses a plain blob URL rather than a SAS URL. If direct URL access lacks permission, the gallery falls back to its attached identity. This support applies to publishing, not deployment onto VMs or scale sets. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications-publish-with-managed-identity).\n\n## Applicability\n\nIdentify the gallery, package blob, storage authorization, and identity used by publication. Keep destination-VM identity and application deployment permissions as separate subjects. Review the source’s trusted-service network behavior and supported management tools against the storage account’s actual restrictions before implementation.\n\n## DSE recommendation\n\nBind the package-reading identity and its storage role to the gallery’s publishing workflow. Have the storage owner review the documented role scope and confirm that the intended identity is attached to the correct gallery. Remove the assumption that granting a role to a destination VM will solve a publication-time blob access problem. Keep authentication evidence free of SAS secrets.\n\n## Verification\n\nPublish a benign test package through the approved gallery using its plain blob URL and inspect the actual result. Check identity assignment and storage access when publication fails before broadening anonymous access or generating a replacement SAS. Then verify application deployment separately using its own supported path. Retain the publisher identity, gallery ID, blob identity, and distinct publish/deploy outcomes without conflating the two authorization stages.\n\n## Official references\n\n[Microsoft Learn: Publish VM Applications using managed identity](https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications-publish-with-managed-identity). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-102-attach-the-publishing-identity-to-the-gallery-not-the-destination-vm/", "url": "https://update.dsesecurity.com/updates/dse-20260909-102-attach-the-publishing-identity-to-the-gallery-not-the-destination-vm/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-102-attach-the-publishing-identity-to-the-gallery-not-the-destination-vm/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Attach the publishing identity to the gallery, not the destination VM", "item": "https://update.dsesecurity.com/updates/dse-20260909-102-attach-the-publishing-identity-to-the-gallery-not-the-destination-vm/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-102-attach-the-publishing-identity-to-the-gallery-not-the-destination-vm/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-102-attach-the-publishing-identity-to-the-gallery-not-the-destination-vm/", "url": "https://update.dsesecurity.com/updates/dse-20260909-102-attach-the-publishing-identity-to-the-gallery-not-the-destination-vm/", "headline": "Attach the publishing identity to the gallery, not the destination VM", "description": "Which identity reads a private application blob when an Azure VM Application version is published?", "abstract": "Which identity reads a private application blob when an Azure VM Application version is published?", "articleBody": "Source facts\nThe documented VM Application publishing flow attaches a user-assigned identity to Compute Gallery and grants it Storage Blob Data Contributor access to the package’s storage account. Publication uses a plain blob URL rather than a SAS URL. If direct URL access lacks permission, the gallery falls back to its attached identity. This support applies to publishing, not deployment onto VMs or scale sets. Microsoft Learn.\nApplicability\nIdentify the gallery, package blob, storage authorization, and identity used by publication. Keep destination-VM identity and application deployment permissions as separate subjects. Review the source’s trusted-service network behavior and supported management tools against the storage account’s actual restrictions before implementation.\nDSE recommendation\nBind the package-reading identity and its storage role to the gallery’s publishing workflow. Have the storage owner review the documented role scope and confirm that the intended identity is attached to the correct gallery. Remove the assumption that granting a role to a destination VM will solve a publication-time blob access problem. Keep authentication evidence free of SAS secrets.\nVerification\nPublish a benign test package through the approved gallery using its plain blob URL and inspect the actual result. Check identity assignment and storage access when publication fails before broadening anonymous access or generating a replacement SAS. Then verify application deployment separately using its own supported path. Retain the publisher identity, gallery ID, blob identity, and distinct publish/deploy outcomes without conflating the two authorization stages.\nOfficial references\nMicrosoft Learn: Publish VM Applications using managed identity. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:30:14+00:00", "dateModified": "2026-09-10T00:52:38+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-102-attach-the-publishing-identity-to-the-gallery-not-the-destination-vm/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-102-attach-the-publishing-identity-to-the-gallery-not-the-destination-vm/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Attach the publishing identity to the gallery, not the destination VM" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 249, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Publish VM applications using managed identity - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications-publish-with-managed-identity" } } ] } }