{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-045-publish-a-machine-configuration-package-with-matching-uri-and-content-hash/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-045-publish-a-machine-configuration-package-with-matching-uri-and-content-hash/", "slug": "dse-20260917-045-publish-a-machine-configuration-package-with-matching-uri-and-content-hash", "url": "https://update.dsesecurity.com/updates/dse-20260917-045-publish-a-machine-configuration-package-with-matching-uri-and-content-hash/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-045-publish-a-machine-configuration-package-with-matching-uri-and-content-hash.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-045-publish-a-machine-configuration-package-with-matching-uri-and-content-hash/" }, "title": "Publish a Machine Configuration package with matching URI and content hash", "summary": "Keep policy metadata aligned with the exact package artifact.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:15+00:00", "modified_at": "2026-09-17T16:35:04+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 215, "potentially_affected": "Apply this review to a new release of an existing custom Machine Configuration package. Identify the generated definition, package artifact and publication location. Keep artifact identity separate from whether the configuration itself is appropriate for the intended machines.", "dse_recommendation": "DSE recommends recording the policy version, package URI and hash together as one release record.", "primary_source": { "name": "How to create custom machine configuration policy definitions - Azure Machine Configuration | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/create-policy-definition", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s custom Machine Configuration policy lifecycle requires the contentHash to match the published ZIP file. New-GuestConfigurationPolicy updates that hash automatically. Changing only contentUri causes the extension to reject the package. The source also calls for a higher policy version and recommends a versioned package filename. Microsoft Learn.

\n

Applicability

\n

Apply this review to a new release of an existing custom Machine Configuration package. Identify the generated definition, package artifact and publication location. Keep artifact identity separate from whether the configuration itself is appropriate for the intended machines.

\n

DSE recommendation

\n

DSE recommends recording the policy version, package URI and hash together as one release record. Generate the definition from the approved package, then have another reviewer compare the published artifact with that record. Preserve the prior package and definition for a controlled reversal. Avoid overwriting an artifact while retaining metadata that describes different content.

\n

Verification

\n

Read the published package back through the intended access path and compare its digest with the policy’s declared hash. Apply the release to an approved test machine and inspect the assignment’s resulting evidence. Confirm that the intended package is evaluated before extending scope. If download or hash validation fails, resolve the artifact mismatch before changing the configuration logic.

\n

Official references

\n

Microsoft Learn: How to create custom machine configuration policy definitions.

", "content_text": "Source facts\nMicrosoft’s custom Machine Configuration policy lifecycle requires the contentHash to match the published ZIP file. New-GuestConfigurationPolicy updates that hash automatically. Changing only contentUri causes the extension to reject the package. The source also calls for a higher policy version and recommends a versioned package filename. Microsoft Learn.\nApplicability\nApply this review to a new release of an existing custom Machine Configuration package. Identify the generated definition, package artifact and publication location. Keep artifact identity separate from whether the configuration itself is appropriate for the intended machines.\nDSE recommendation\nDSE recommends recording the policy version, package URI and hash together as one release record. Generate the definition from the approved package, then have another reviewer compare the published artifact with that record. Preserve the prior package and definition for a controlled reversal. Avoid overwriting an artifact while retaining metadata that describes different content.\nVerification\nRead the published package back through the intended access path and compare its digest with the policy’s declared hash. Apply the release to an approved test machine and inspect the assignment’s resulting evidence. Confirm that the intended package is evaluated before extending scope. If download or hash validation fails, resolve the artifact mismatch before changing the configuration logic.\nOfficial references\nMicrosoft Learn: How to create custom machine configuration policy definitions.", "content_markdown": "## Source facts\n\nMicrosoft’s custom Machine Configuration policy lifecycle requires the contentHash to match the published ZIP file. New-GuestConfigurationPolicy updates that hash automatically. Changing only contentUri causes the extension to reject the package. The source also calls for a higher policy version and recommends a versioned package filename. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/create-policy-definition).\n\n## Applicability\n\nApply this review to a new release of an existing custom Machine Configuration package. Identify the generated definition, package artifact and publication location. Keep artifact identity separate from whether the configuration itself is appropriate for the intended machines.\n\n## DSE recommendation\n\nDSE recommends recording the policy version, package URI and hash together as one release record. Generate the definition from the approved package, then have another reviewer compare the published artifact with that record. Preserve the prior package and definition for a controlled reversal. Avoid overwriting an artifact while retaining metadata that describes different content.\n\n## Verification\n\nRead the published package back through the intended access path and compare its digest with the policy’s declared hash. Apply the release to an approved test machine and inspect the assignment’s resulting evidence. Confirm that the intended package is evaluated before extending scope. If download or hash validation fails, resolve the artifact mismatch before changing the configuration logic.\n\n## Official references\n\n[Microsoft Learn: How to create custom machine configuration policy definitions](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/create-policy-definition)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-045-publish-a-machine-configuration-package-with-matching-uri-and-content-hash/", "url": "https://update.dsesecurity.com/updates/dse-20260917-045-publish-a-machine-configuration-package-with-matching-uri-and-content-hash/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-045-publish-a-machine-configuration-package-with-matching-uri-and-content-hash/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Publish a Machine Configuration package with matching URI and content hash", "item": "https://update.dsesecurity.com/updates/dse-20260917-045-publish-a-machine-configuration-package-with-matching-uri-and-content-hash/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-045-publish-a-machine-configuration-package-with-matching-uri-and-content-hash/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-045-publish-a-machine-configuration-package-with-matching-uri-and-content-hash/", "url": "https://update.dsesecurity.com/updates/dse-20260917-045-publish-a-machine-configuration-package-with-matching-uri-and-content-hash/", "headline": "Publish a Machine Configuration package with matching URI and content hash", "description": "Keep policy metadata aligned with the exact package artifact.", "abstract": "Keep policy metadata aligned with the exact package artifact.", "articleBody": "Source facts\nMicrosoft’s custom Machine Configuration policy lifecycle requires the contentHash to match the published ZIP file. New-GuestConfigurationPolicy updates that hash automatically. Changing only contentUri causes the extension to reject the package. The source also calls for a higher policy version and recommends a versioned package filename. Microsoft Learn.\nApplicability\nApply this review to a new release of an existing custom Machine Configuration package. Identify the generated definition, package artifact and publication location. Keep artifact identity separate from whether the configuration itself is appropriate for the intended machines.\nDSE recommendation\nDSE recommends recording the policy version, package URI and hash together as one release record. Generate the definition from the approved package, then have another reviewer compare the published artifact with that record. Preserve the prior package and definition for a controlled reversal. Avoid overwriting an artifact while retaining metadata that describes different content.\nVerification\nRead the published package back through the intended access path and compare its digest with the policy’s declared hash. Apply the release to an approved test machine and inspect the assignment’s resulting evidence. Confirm that the intended package is evaluated before extending scope. If download or hash validation fails, resolve the artifact mismatch before changing the configuration logic.\nOfficial references\nMicrosoft Learn: How to create custom machine configuration policy definitions.", "datePublished": "2026-09-17T16:34:15+00:00", "dateModified": "2026-09-17T16:35:04+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-045-publish-a-machine-configuration-package-with-matching-uri-and-content-hash/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-045-publish-a-machine-configuration-package-with-matching-uri-and-content-hash/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Publish a Machine Configuration package with matching URI and content hash" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 215, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "How to create custom machine configuration policy definitions - Azure Machine Configuration | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/create-policy-definition" } } ] } }