{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-325-validate-the-expanded-machine-configuration-package-not-just-its-zip-size/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-325-validate-the-expanded-machine-configuration-package-not-just-its-zip-size/", "slug": "dse-20260909-325-validate-the-expanded-machine-configuration-package-not-just-its-zip-size", "url": "https://update.dsesecurity.com/updates/dse-20260909-325-validate-the-expanded-machine-configuration-package-not-just-its-zip-size/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-325-validate-the-expanded-machine-configuration-package-not-just-its-zip-size.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-325-validate-the-expanded-machine-configuration-package-not-just-its-zip-size/" }, "title": "Validate the expanded Machine Configuration package, not just its ZIP size", "summary": "Custom package acceptance depends on its uncompressed size and bundled configuration dependencies.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:26:31+00:00", "modified_at": "2026-09-10T01:40:03+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 237, "potentially_affected": "Custom Azure Machine Configuration package artifacts for supported Windows or Linux targets.", "dse_recommendation": "Inspect the expanded artifact, dependency contents and confidential-data exclusions before publishing a custom package.", "primary_source": { "name": "How to create custom machine configuration package artifacts - Azure Machine Configuration | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/develop-custom-package/2-create-package", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

A Machine Configuration artifact must be a ZIP archive no larger than 100 MB when uncompressed. The expected contents include the compiled MOF, required DSC resource modules and a metaconfig file describing package type and version; no root or version folder is required.

\n

The packaging command collects required modules from the authoring environment’s PSModulePath. Microsoft separately warns against placing secrets or confidential information in custom packages. Microsoft Learn.

\n

Applicability

\n

Identify the intended target platforms and documented authoring prerequisites. This check concerns the completed artifact, not whether the target has the network access or agent version required to use it.

\n

DSE recommendation

\n

DSE recommends inspecting a safely expanded copy of the built package before release. Measure its total uncompressed content and compare the module inventory with the compiled configuration’s dependencies. Review included files for unintended credentials or confidential material. Record the exact tested artifact and authoring environment so a later rebuild does not silently substitute a different dependency set.

\n

Verification

\n

Use a clean, approved test environment to validate the package and its expected configuration behavior. Confirm required modules are inside the artifact rather than merely installed on the build machine. Retain the size calculation, file inventory and test result. Do not accept a package solely because compression brought the download below 100 MB or because the authoring workstation already had every dependency available.

\n

Official references

\n

Microsoft Learn: How to create custom machine configuration package artifacts. Source retrieved September 9, 2026.

", "content_text": "Source facts\nA Machine Configuration artifact must be a ZIP archive no larger than 100 MB when uncompressed. The expected contents include the compiled MOF, required DSC resource modules and a metaconfig file describing package type and version; no root or version folder is required.\nThe packaging command collects required modules from the authoring environment’s PSModulePath. Microsoft separately warns against placing secrets or confidential information in custom packages. Microsoft Learn.\nApplicability\nIdentify the intended target platforms and documented authoring prerequisites. This check concerns the completed artifact, not whether the target has the network access or agent version required to use it.\nDSE recommendation\nDSE recommends inspecting a safely expanded copy of the built package before release. Measure its total uncompressed content and compare the module inventory with the compiled configuration’s dependencies. Review included files for unintended credentials or confidential material. Record the exact tested artifact and authoring environment so a later rebuild does not silently substitute a different dependency set.\nVerification\nUse a clean, approved test environment to validate the package and its expected configuration behavior. Confirm required modules are inside the artifact rather than merely installed on the build machine. Retain the size calculation, file inventory and test result. Do not accept a package solely because compression brought the download below 100 MB or because the authoring workstation already had every dependency available.\nOfficial references\nMicrosoft Learn: How to create custom machine configuration package artifacts. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nA Machine Configuration artifact must be a ZIP archive no larger than 100 MB when uncompressed. The expected contents include the compiled MOF, required DSC resource modules and a metaconfig file describing package type and version; no root or version folder is required.\n\nThe packaging command collects required modules from the authoring environment’s PSModulePath. Microsoft separately warns against placing secrets or confidential information in custom packages. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/develop-custom-package/2-create-package).\n\n## Applicability\n\nIdentify the intended target platforms and documented authoring prerequisites. This check concerns the completed artifact, not whether the target has the network access or agent version required to use it.\n\n## DSE recommendation\n\nDSE recommends inspecting a safely expanded copy of the built package before release. Measure its total uncompressed content and compare the module inventory with the compiled configuration’s dependencies. Review included files for unintended credentials or confidential material. Record the exact tested artifact and authoring environment so a later rebuild does not silently substitute a different dependency set.\n\n## Verification\n\nUse a clean, approved test environment to validate the package and its expected configuration behavior. Confirm required modules are inside the artifact rather than merely installed on the build machine. Retain the size calculation, file inventory and test result. Do not accept a package solely because compression brought the download below 100 MB or because the authoring workstation already had every dependency available.\n\n## Official references\n\n[Microsoft Learn: How to create custom machine configuration package artifacts](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/develop-custom-package/2-create-package). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-325-validate-the-expanded-machine-configuration-package-not-just-its-zip-size/", "url": "https://update.dsesecurity.com/updates/dse-20260909-325-validate-the-expanded-machine-configuration-package-not-just-its-zip-size/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-325-validate-the-expanded-machine-configuration-package-not-just-its-zip-size/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Validate the expanded Machine Configuration package, not just its ZIP size", "item": "https://update.dsesecurity.com/updates/dse-20260909-325-validate-the-expanded-machine-configuration-package-not-just-its-zip-size/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-325-validate-the-expanded-machine-configuration-package-not-just-its-zip-size/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-325-validate-the-expanded-machine-configuration-package-not-just-its-zip-size/", "url": "https://update.dsesecurity.com/updates/dse-20260909-325-validate-the-expanded-machine-configuration-package-not-just-its-zip-size/", "headline": "Validate the expanded Machine Configuration package, not just its ZIP size", "description": "Custom package acceptance depends on its uncompressed size and bundled configuration dependencies.", "abstract": "Custom package acceptance depends on its uncompressed size and bundled configuration dependencies.", "articleBody": "Source facts\nA Machine Configuration artifact must be a ZIP archive no larger than 100 MB when uncompressed. The expected contents include the compiled MOF, required DSC resource modules and a metaconfig file describing package type and version; no root or version folder is required.\nThe packaging command collects required modules from the authoring environment’s PSModulePath. Microsoft separately warns against placing secrets or confidential information in custom packages. Microsoft Learn.\nApplicability\nIdentify the intended target platforms and documented authoring prerequisites. This check concerns the completed artifact, not whether the target has the network access or agent version required to use it.\nDSE recommendation\nDSE recommends inspecting a safely expanded copy of the built package before release. Measure its total uncompressed content and compare the module inventory with the compiled configuration’s dependencies. Review included files for unintended credentials or confidential material. Record the exact tested artifact and authoring environment so a later rebuild does not silently substitute a different dependency set.\nVerification\nUse a clean, approved test environment to validate the package and its expected configuration behavior. Confirm required modules are inside the artifact rather than merely installed on the build machine. Retain the size calculation, file inventory and test result. Do not accept a package solely because compression brought the download below 100 MB or because the authoring workstation already had every dependency available.\nOfficial references\nMicrosoft Learn: How to create custom machine configuration package artifacts. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:26:31+00:00", "dateModified": "2026-09-10T01:40:03+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-325-validate-the-expanded-machine-configuration-package-not-just-its-zip-size/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-325-validate-the-expanded-machine-configuration-package-not-just-its-zip-size/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Validate the expanded Machine Configuration package, not just its ZIP size" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 237, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "How to create custom machine configuration package artifacts - Azure Machine Configuration | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/develop-custom-package/2-create-package" } } ] } }