{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-559-validate-linux-extension-readiness-across-platform-opt-in-guest-mode-and-agent/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-559-validate-linux-extension-readiness-across-platform-opt-in-guest-mode-and-agent/", "slug": "dse-20260909-559-validate-linux-extension-readiness-across-platform-opt-in-guest-mode-and-agent", "url": "https://update.dsesecurity.com/updates/dse-20260909-559-validate-linux-extension-readiness-across-platform-opt-in-guest-mode-and-agent/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-559-validate-linux-extension-readiness-across-platform-opt-in-guest-mode-and-agent.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-559-validate-linux-extension-readiness-across-platform-opt-in-guest-mode-and-agent/" }, "title": "Validate Linux extension readiness across platform opt-in, guest mode, and agent version", "summary": "Is setting the Azure FIPS 140-3 extension-encryption flag sufficient to establish a working Linux extension path?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:22:37+00:00", "modified_at": "2026-09-10T02:14:31+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 244, "potentially_affected": "Linux Azure VMs preparing for FIPS 140-3 extension-encryption support; this is a technical readiness check, not a compliance certification.", "dse_recommendation": "Record platform opt-in, guest configuration, agent readiness, and protected-settings execution as separate acceptance checks.", "primary_source": { "name": "FIPS 140-3 Support for Azure Linux VM Extensions and Guest Agent - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/agent-linux-fips", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure’s Linux FIPS 140-3 extension support requires per-VM platform opt-in as well as guest FIPS configuration and a compatible agent. Microsoft specifies Goal State Agent version 2.14.0.1 or later and validation of extension functionality. It warns against production opt-in on RHEL 9.5/9.6 with WALinuxAgent 2.7.0.6: after enablement and reboot, the agent can loop instead of becoming ready, preventing extensions from functioning. The documented RHEL workaround is for testing only. Microsoft Learn.

\n

Applicability

\n

Use this technical readiness check for a Linux VM whose requirements call for the newer extension-encryption behavior. Inventory the actual distribution and both agent components before applying a platform flag. This article does not certify the workload or recommend using a test workaround in production.

\n

DSE recommendation

\n

Record platform opt-in, guest configuration, agent readiness, and protected-settings execution as separate acceptance checks. Assign the guest configuration and extension tests to named operational owners. Hold a known affected RHEL/agent combination for a supported resolution rather than masking its readiness failure with the source’s test-only patch.

\n

Verification

\n

On an approved test VM, inspect the platform property and guest configuration, then verify that the agent reaches Ready. Exercise a benign extension operation that actually uses protected settings and inspect its completion. Retain the exact versions and test result without including decrypted settings in the evidence. An enabled property alone should not close the investigation if the agent or extension path remains broken.

\n

Official references

\n

Microsoft Learn: Linux guest-agent and extension FIPS 140-3 support. Source reviewed September 9, 2026.

", "content_text": "Source facts\nAzure’s Linux FIPS 140-3 extension support requires per-VM platform opt-in as well as guest FIPS configuration and a compatible agent. Microsoft specifies Goal State Agent version 2.14.0.1 or later and validation of extension functionality. It warns against production opt-in on RHEL 9.5/9.6 with WALinuxAgent 2.7.0.6: after enablement and reboot, the agent can loop instead of becoming ready, preventing extensions from functioning. The documented RHEL workaround is for testing only. Microsoft Learn.\nApplicability\nUse this technical readiness check for a Linux VM whose requirements call for the newer extension-encryption behavior. Inventory the actual distribution and both agent components before applying a platform flag. This article does not certify the workload or recommend using a test workaround in production.\nDSE recommendation\nRecord platform opt-in, guest configuration, agent readiness, and protected-settings execution as separate acceptance checks. Assign the guest configuration and extension tests to named operational owners. Hold a known affected RHEL/agent combination for a supported resolution rather than masking its readiness failure with the source’s test-only patch.\nVerification\nOn an approved test VM, inspect the platform property and guest configuration, then verify that the agent reaches Ready. Exercise a benign extension operation that actually uses protected settings and inspect its completion. Retain the exact versions and test result without including decrypted settings in the evidence. An enabled property alone should not close the investigation if the agent or extension path remains broken.\nOfficial references\nMicrosoft Learn: Linux guest-agent and extension FIPS 140-3 support. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nAzure’s Linux FIPS 140-3 extension support requires per-VM platform opt-in as well as guest FIPS configuration and a compatible agent. Microsoft specifies Goal State Agent version 2.14.0.1 or later and validation of extension functionality. It warns against production opt-in on RHEL 9.5/9.6 with WALinuxAgent 2.7.0.6: after enablement and reboot, the agent can loop instead of becoming ready, preventing extensions from functioning. The documented RHEL workaround is for testing only. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/agent-linux-fips).\n\n## Applicability\n\nUse this technical readiness check for a Linux VM whose requirements call for the newer extension-encryption behavior. Inventory the actual distribution and both agent components before applying a platform flag. This article does not certify the workload or recommend using a test workaround in production.\n\n## DSE recommendation\n\nRecord platform opt-in, guest configuration, agent readiness, and protected-settings execution as separate acceptance checks. Assign the guest configuration and extension tests to named operational owners. Hold a known affected RHEL/agent combination for a supported resolution rather than masking its readiness failure with the source’s test-only patch.\n\n## Verification\n\nOn an approved test VM, inspect the platform property and guest configuration, then verify that the agent reaches Ready. Exercise a benign extension operation that actually uses protected settings and inspect its completion. Retain the exact versions and test result without including decrypted settings in the evidence. An enabled property alone should not close the investigation if the agent or extension path remains broken.\n\n## Official references\n\n[Microsoft Learn: Linux guest-agent and extension FIPS 140-3 support](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/agent-linux-fips). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-559-validate-linux-extension-readiness-across-platform-opt-in-guest-mode-and-agent/", "url": "https://update.dsesecurity.com/updates/dse-20260909-559-validate-linux-extension-readiness-across-platform-opt-in-guest-mode-and-agent/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-559-validate-linux-extension-readiness-across-platform-opt-in-guest-mode-and-agent/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Validate Linux extension readiness across platform opt-in, guest mode, and agent version", "item": "https://update.dsesecurity.com/updates/dse-20260909-559-validate-linux-extension-readiness-across-platform-opt-in-guest-mode-and-agent/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-559-validate-linux-extension-readiness-across-platform-opt-in-guest-mode-and-agent/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-559-validate-linux-extension-readiness-across-platform-opt-in-guest-mode-and-agent/", "url": "https://update.dsesecurity.com/updates/dse-20260909-559-validate-linux-extension-readiness-across-platform-opt-in-guest-mode-and-agent/", "headline": "Validate Linux extension readiness across platform opt-in, guest mode, and agent version", "description": "Is setting the Azure FIPS 140-3 extension-encryption flag sufficient to establish a working Linux extension path?", "abstract": "Is setting the Azure FIPS 140-3 extension-encryption flag sufficient to establish a working Linux extension path?", "articleBody": "Source facts\nAzure’s Linux FIPS 140-3 extension support requires per-VM platform opt-in as well as guest FIPS configuration and a compatible agent. Microsoft specifies Goal State Agent version 2.14.0.1 or later and validation of extension functionality. It warns against production opt-in on RHEL 9.5/9.6 with WALinuxAgent 2.7.0.6: after enablement and reboot, the agent can loop instead of becoming ready, preventing extensions from functioning. The documented RHEL workaround is for testing only. Microsoft Learn.\nApplicability\nUse this technical readiness check for a Linux VM whose requirements call for the newer extension-encryption behavior. Inventory the actual distribution and both agent components before applying a platform flag. This article does not certify the workload or recommend using a test workaround in production.\nDSE recommendation\nRecord platform opt-in, guest configuration, agent readiness, and protected-settings execution as separate acceptance checks. Assign the guest configuration and extension tests to named operational owners. Hold a known affected RHEL/agent combination for a supported resolution rather than masking its readiness failure with the source’s test-only patch.\nVerification\nOn an approved test VM, inspect the platform property and guest configuration, then verify that the agent reaches Ready. Exercise a benign extension operation that actually uses protected settings and inspect its completion. Retain the exact versions and test result without including decrypted settings in the evidence. An enabled property alone should not close the investigation if the agent or extension path remains broken.\nOfficial references\nMicrosoft Learn: Linux guest-agent and extension FIPS 140-3 support. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:22:37+00:00", "dateModified": "2026-09-10T02:14:31+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-559-validate-linux-extension-readiness-across-platform-opt-in-guest-mode-and-agent/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-559-validate-linux-extension-readiness-across-platform-opt-in-guest-mode-and-agent/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Validate Linux extension readiness across platform opt-in, guest mode, and agent version" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 244, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "FIPS 140-3 Support for Azure Linux VM Extensions and Guest Agent - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/agent-linux-fips" } } ] } }