{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-434-use-an-explicit-rerun-signal-when-a-scale-set-extension-s-script-uri-stays/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-434-use-an-explicit-rerun-signal-when-a-scale-set-extension-s-script-uri-stays/", "slug": "dse-20260909-434-use-an-explicit-rerun-signal-when-a-scale-set-extension-s-script-uri-stays", "url": "https://update.dsesecurity.com/updates/dse-20260909-434-use-an-explicit-rerun-signal-when-a-scale-set-extension-s-script-uri-stays/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-434-use-an-explicit-rerun-signal-when-a-scale-set-extension-s-script-uri-stays.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-434-use-an-explicit-rerun-signal-when-a-scale-set-extension-s-script-uri-stays/" }, "title": "Use an explicit rerun signal when a scale-set extension's script URI stays unchanged", "summary": "How can a scale-set extension be rerun when its script content changes but its configuration URI does not?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:24:42+00:00", "modified_at": "2026-09-10T02:04:57+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 236, "potentially_affected": "Owners maintaining application extensions on existing Azure scale sets, with procedures matched to orchestration mode.", "dse_recommendation": "Record the intended script revision and an explicit extension-rerun decision together.", "primary_source": { "name": "Modify an Azure Virtual Machine Scale Set - Azure Virtual Machine Scale Sets | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-upgrade-scale-set", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft documents forceUpdateTag for rerunning a scale-set extension even when its ordinary configuration is unchanged, such as revised script contents at the same URI. Azure does not interpret the tag’s value as instructions; changing it triggers rerun. This mechanism is available to extensions generally, not only Custom Script. Extension-configuration updates follow the scale set’s upgrade policy. Microsoft Learn.

\n

Applicability

\n

Use this review when a deployment workflow publishes a new payload without changing the configured source address. The source notes that many procedures target Uniform orchestration, so confirm the management path for the actual scale set before applying a model change.

\n

DSE recommendation

\n

Record the intended script revision and an explicit extension-rerun decision together. Have the deployment owner connect the rerun request to a specific reviewed payload and the intended instance population. Check that repeating the extension’s work is acceptable for the application. Keep the tag’s purpose explicit rather than treating its text as an argument that changes how the script executes.

\n

Verification

\n

In a controlled rollout, compare extension execution evidence with the intended payload revision on representative instances. Confirm the configured upgrade policy has reached the planned population before declaring completion. Preserve any instances that remain pending or failed as unresolved work. A changed tag in the desired model should not substitute for proof that the intended application operation actually ran.

\n

Official references

\n

Microsoft Learn: Modify a Virtual Machine Scale Set. Source reviewed September 9, 2026.

", "content_text": "Source facts\nMicrosoft documents forceUpdateTag for rerunning a scale-set extension even when its ordinary configuration is unchanged, such as revised script contents at the same URI. Azure does not interpret the tag’s value as instructions; changing it triggers rerun. This mechanism is available to extensions generally, not only Custom Script. Extension-configuration updates follow the scale set’s upgrade policy. Microsoft Learn.\nApplicability\nUse this review when a deployment workflow publishes a new payload without changing the configured source address. The source notes that many procedures target Uniform orchestration, so confirm the management path for the actual scale set before applying a model change.\nDSE recommendation\nRecord the intended script revision and an explicit extension-rerun decision together. Have the deployment owner connect the rerun request to a specific reviewed payload and the intended instance population. Check that repeating the extension’s work is acceptable for the application. Keep the tag’s purpose explicit rather than treating its text as an argument that changes how the script executes.\nVerification\nIn a controlled rollout, compare extension execution evidence with the intended payload revision on representative instances. Confirm the configured upgrade policy has reached the planned population before declaring completion. Preserve any instances that remain pending or failed as unresolved work. A changed tag in the desired model should not substitute for proof that the intended application operation actually ran.\nOfficial references\nMicrosoft Learn: Modify a Virtual Machine Scale Set. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nMicrosoft documents forceUpdateTag for rerunning a scale-set extension even when its ordinary configuration is unchanged, such as revised script contents at the same URI. Azure does not interpret the tag’s value as instructions; changing it triggers rerun. This mechanism is available to extensions generally, not only Custom Script. Extension-configuration updates follow the scale set’s upgrade policy. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-upgrade-scale-set).\n\n## Applicability\n\nUse this review when a deployment workflow publishes a new payload without changing the configured source address. The source notes that many procedures target Uniform orchestration, so confirm the management path for the actual scale set before applying a model change.\n\n## DSE recommendation\n\nRecord the intended script revision and an explicit extension-rerun decision together. Have the deployment owner connect the rerun request to a specific reviewed payload and the intended instance population. Check that repeating the extension’s work is acceptable for the application. Keep the tag’s purpose explicit rather than treating its text as an argument that changes how the script executes.\n\n## Verification\n\nIn a controlled rollout, compare extension execution evidence with the intended payload revision on representative instances. Confirm the configured upgrade policy has reached the planned population before declaring completion. Preserve any instances that remain pending or failed as unresolved work. A changed tag in the desired model should not substitute for proof that the intended application operation actually ran.\n\n## Official references\n\n[Microsoft Learn: Modify a Virtual Machine Scale Set](https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-upgrade-scale-set). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-434-use-an-explicit-rerun-signal-when-a-scale-set-extension-s-script-uri-stays/", "url": "https://update.dsesecurity.com/updates/dse-20260909-434-use-an-explicit-rerun-signal-when-a-scale-set-extension-s-script-uri-stays/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-434-use-an-explicit-rerun-signal-when-a-scale-set-extension-s-script-uri-stays/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Use an explicit rerun signal when a scale-set extension's script URI stays unchanged", "item": "https://update.dsesecurity.com/updates/dse-20260909-434-use-an-explicit-rerun-signal-when-a-scale-set-extension-s-script-uri-stays/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-434-use-an-explicit-rerun-signal-when-a-scale-set-extension-s-script-uri-stays/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-434-use-an-explicit-rerun-signal-when-a-scale-set-extension-s-script-uri-stays/", "url": "https://update.dsesecurity.com/updates/dse-20260909-434-use-an-explicit-rerun-signal-when-a-scale-set-extension-s-script-uri-stays/", "headline": "Use an explicit rerun signal when a scale-set extension's script URI stays unchanged", "description": "How can a scale-set extension be rerun when its script content changes but its configuration URI does not?", "abstract": "How can a scale-set extension be rerun when its script content changes but its configuration URI does not?", "articleBody": "Source facts\nMicrosoft documents forceUpdateTag for rerunning a scale-set extension even when its ordinary configuration is unchanged, such as revised script contents at the same URI. Azure does not interpret the tag’s value as instructions; changing it triggers rerun. This mechanism is available to extensions generally, not only Custom Script. Extension-configuration updates follow the scale set’s upgrade policy. Microsoft Learn.\nApplicability\nUse this review when a deployment workflow publishes a new payload without changing the configured source address. The source notes that many procedures target Uniform orchestration, so confirm the management path for the actual scale set before applying a model change.\nDSE recommendation\nRecord the intended script revision and an explicit extension-rerun decision together. Have the deployment owner connect the rerun request to a specific reviewed payload and the intended instance population. Check that repeating the extension’s work is acceptable for the application. Keep the tag’s purpose explicit rather than treating its text as an argument that changes how the script executes.\nVerification\nIn a controlled rollout, compare extension execution evidence with the intended payload revision on representative instances. Confirm the configured upgrade policy has reached the planned population before declaring completion. Preserve any instances that remain pending or failed as unresolved work. A changed tag in the desired model should not substitute for proof that the intended application operation actually ran.\nOfficial references\nMicrosoft Learn: Modify a Virtual Machine Scale Set. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:24:42+00:00", "dateModified": "2026-09-10T02:04:57+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-434-use-an-explicit-rerun-signal-when-a-scale-set-extension-s-script-uri-stays/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-434-use-an-explicit-rerun-signal-when-a-scale-set-extension-s-script-uri-stays/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Use an explicit rerun signal when a scale-set extension's script URI stays unchanged" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 236, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Modify an Azure Virtual Machine Scale Set - Azure Virtual Machine Scale Sets | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-upgrade-scale-set" } } ] } }