{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-332-read-the-managed-run-command-script-result-separately-from-provisioning-status/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-332-read-the-managed-run-command-script-result-separately-from-provisioning-status/", "slug": "dse-20260909-332-read-the-managed-run-command-script-result-separately-from-provisioning-status", "url": "https://update.dsesecurity.com/updates/dse-20260909-332-read-the-managed-run-command-script-result-separately-from-provisioning-status/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-332-read-the-managed-run-command-script-result-separately-from-provisioning-status.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-332-read-the-managed-run-command-script-result-separately-from-provisioning-status/" }, "title": "Read the managed Run Command script result separately from provisioning status", "summary": "Can a managed Run Command resource provision successfully while the Windows script itself fails?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:26:24+00:00", "modified_at": "2026-09-10T01:40:03+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 242, "potentially_affected": "Windows Azure VMs using managed Run Command resources through CLI, PowerShell, or API.", "dse_recommendation": "Require the script's execution state and exit code in completion evidence, with deployment-failure propagation chosen explicitly.", "primary_source": { "name": "Run scripts in a Windows VM in Azure using managed Run Commands - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-command-managed", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Managed Run Command distinguishes extension provisioning from the script’s execution result. The expanded instance view exposes execution state, exit code, output, and error; a nonzero exit code indicates failure. With treatFailureAsDeploymentFailure set false, provisioning status does not report script failure. API version 2023-03-01 introduced the option to set that property true and fail deployment when the script fails. Instance-view output and error retain only their final 4 KB. Microsoft Learn.

\n

Applicability

\n

Use this acceptance check for managed Run Command on Windows VMs, not merely the original action-oriented command interface. Identify the exact named command resource and whether the caller expects script failure to fail the surrounding deployment. Keep transport or provisioning success separate from the application’s intended result.

\n

DSE recommendation

\n

Require the script’s execution state and exit code in completion evidence, with deployment-failure propagation chosen explicitly. Have the script owner document meaningful failure exits and any output that must be retained beyond the instance-view tail. Avoid declaring a repair complete from a successful resource deployment alone.

\n

Verification

\n

Run a benign success case and a deliberately failing case on a disposable VM. For each, compare provisioning state, expanded execution state, exit code, and the deployment result under the selected setting. Inspect the script’s actual target condition separately. Retain the exact command identity and terminal result so later cleanup or another execution cannot be mistaken for the run being reviewed.

\n

Official references

\n

Microsoft Learn: Managed Run Command for Windows. Source reviewed September 9, 2026.

", "content_text": "Source facts\nManaged Run Command distinguishes extension provisioning from the script’s execution result. The expanded instance view exposes execution state, exit code, output, and error; a nonzero exit code indicates failure. With treatFailureAsDeploymentFailure set false, provisioning status does not report script failure. API version 2023-03-01 introduced the option to set that property true and fail deployment when the script fails. Instance-view output and error retain only their final 4 KB. Microsoft Learn.\nApplicability\nUse this acceptance check for managed Run Command on Windows VMs, not merely the original action-oriented command interface. Identify the exact named command resource and whether the caller expects script failure to fail the surrounding deployment. Keep transport or provisioning success separate from the application’s intended result.\nDSE recommendation\nRequire the script’s execution state and exit code in completion evidence, with deployment-failure propagation chosen explicitly. Have the script owner document meaningful failure exits and any output that must be retained beyond the instance-view tail. Avoid declaring a repair complete from a successful resource deployment alone.\nVerification\nRun a benign success case and a deliberately failing case on a disposable VM. For each, compare provisioning state, expanded execution state, exit code, and the deployment result under the selected setting. Inspect the script’s actual target condition separately. Retain the exact command identity and terminal result so later cleanup or another execution cannot be mistaken for the run being reviewed.\nOfficial references\nMicrosoft Learn: Managed Run Command for Windows. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nManaged Run Command distinguishes extension provisioning from the script’s execution result. The expanded instance view exposes execution state, exit code, output, and error; a nonzero exit code indicates failure. With treatFailureAsDeploymentFailure set false, provisioning status does not report script failure. API version 2023-03-01 introduced the option to set that property true and fail deployment when the script fails. Instance-view output and error retain only their final 4 KB. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-command-managed).\n\n## Applicability\n\nUse this acceptance check for managed Run Command on Windows VMs, not merely the original action-oriented command interface. Identify the exact named command resource and whether the caller expects script failure to fail the surrounding deployment. Keep transport or provisioning success separate from the application’s intended result.\n\n## DSE recommendation\n\nRequire the script’s execution state and exit code in completion evidence, with deployment-failure propagation chosen explicitly. Have the script owner document meaningful failure exits and any output that must be retained beyond the instance-view tail. Avoid declaring a repair complete from a successful resource deployment alone.\n\n## Verification\n\nRun a benign success case and a deliberately failing case on a disposable VM. For each, compare provisioning state, expanded execution state, exit code, and the deployment result under the selected setting. Inspect the script’s actual target condition separately. Retain the exact command identity and terminal result so later cleanup or another execution cannot be mistaken for the run being reviewed.\n\n## Official references\n\n[Microsoft Learn: Managed Run Command for Windows](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-command-managed). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-332-read-the-managed-run-command-script-result-separately-from-provisioning-status/", "url": "https://update.dsesecurity.com/updates/dse-20260909-332-read-the-managed-run-command-script-result-separately-from-provisioning-status/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-332-read-the-managed-run-command-script-result-separately-from-provisioning-status/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Read the managed Run Command script result separately from provisioning status", "item": "https://update.dsesecurity.com/updates/dse-20260909-332-read-the-managed-run-command-script-result-separately-from-provisioning-status/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-332-read-the-managed-run-command-script-result-separately-from-provisioning-status/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-332-read-the-managed-run-command-script-result-separately-from-provisioning-status/", "url": "https://update.dsesecurity.com/updates/dse-20260909-332-read-the-managed-run-command-script-result-separately-from-provisioning-status/", "headline": "Read the managed Run Command script result separately from provisioning status", "description": "Can a managed Run Command resource provision successfully while the Windows script itself fails?", "abstract": "Can a managed Run Command resource provision successfully while the Windows script itself fails?", "articleBody": "Source facts\nManaged Run Command distinguishes extension provisioning from the script’s execution result. The expanded instance view exposes execution state, exit code, output, and error; a nonzero exit code indicates failure. With treatFailureAsDeploymentFailure set false, provisioning status does not report script failure. API version 2023-03-01 introduced the option to set that property true and fail deployment when the script fails. Instance-view output and error retain only their final 4 KB. Microsoft Learn.\nApplicability\nUse this acceptance check for managed Run Command on Windows VMs, not merely the original action-oriented command interface. Identify the exact named command resource and whether the caller expects script failure to fail the surrounding deployment. Keep transport or provisioning success separate from the application’s intended result.\nDSE recommendation\nRequire the script’s execution state and exit code in completion evidence, with deployment-failure propagation chosen explicitly. Have the script owner document meaningful failure exits and any output that must be retained beyond the instance-view tail. Avoid declaring a repair complete from a successful resource deployment alone.\nVerification\nRun a benign success case and a deliberately failing case on a disposable VM. For each, compare provisioning state, expanded execution state, exit code, and the deployment result under the selected setting. Inspect the script’s actual target condition separately. Retain the exact command identity and terminal result so later cleanup or another execution cannot be mistaken for the run being reviewed.\nOfficial references\nMicrosoft Learn: Managed Run Command for Windows. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:26:24+00:00", "dateModified": "2026-09-10T01:40:03+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-332-read-the-managed-run-command-script-result-separately-from-provisioning-status/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-332-read-the-managed-run-command-script-result-separately-from-provisioning-status/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Read the managed Run Command script result separately from provisioning status" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 242, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Run scripts in a Windows VM in Azure using managed Run Commands - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-command-managed" } } ] } }