Test boot-diagnostics capture separately from an operator's ability to view it

Source facts

Azure boot diagnostics collects serial output and screenshots for investigating startup failures. With firewall-protected custom storage, Microsoft requires access for Azure to publish that evidence and separate firewall allowances for the operator’s viewing network. Viewing also requires the appropriate read and view permissions. The custom account must share the VM’s region and subscription. Managed boot diagnostics offers no configurable retention period and overwrites logs after their total size exceeds 1 GB. Microsoft Learn.

Applicability

Identify whether each VM uses managed or custom diagnostic storage before investigating an empty view. For custom storage, record the selected account and the approved support workstation’s network. Check the source’s supported account types and VM limitations instead of copying a storage policy from unrelated evidence systems.

DSE recommendation

Test platform capture and authorized operator viewing as two separate checks before relying on boot diagnostics. Assign the VM owner to identify an expected startup observation and the storage owner to review its access path. Establish a deliberate preservation step for evidence needed beyond the live troubleshooting session. Keep that decision separate from normal application-log retention.

Verification

During an approved diagnostic exercise, confirm that a current screenshot and serial output can be retrieved by the intended responder. Compare an authorized viewing path with an intentionally unapproved one, without widening production access simply to make the test pass. Record the VM, storage mode, observation time, and retrieval result. Investigate whether a missing artifact was never captured or merely could not be read before declaring the diagnostic feature unavailable.

Official references

Microsoft Learn: Azure boot diagnostics. Source reviewed September 9, 2026.