# Require a separate completion signal for cloud-init custom-data work

> Why should an Azure VM's ready state not be the only acceptance signal for custom-data provisioning?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-042-require-a-separate-completion-signal-for-cloud-init-custom-data-work/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:31:14+00:00
- Modified: 2026-09-10T00:32:00+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Why should an Azure VM's ready state not be the only acceptance signal for custom-data provisioning?

## Potentially affected

Teams provisioning Azure Linux VMs with cloud-init custom-data payloads.

## DSE recommendation

Define an explicit completion and failure signal for the custom-data task before allowing dependent deployment steps.

## Article

## Source facts

Azure supplies custom data during initial VM provisioning. The cloud-init agent processes it by default, but reports the VM ready without waiting for the user’s custom-data work to finish. Errors while processing that configuration or its scripts do not themselves constitute a fatal provisioning failure. Microsoft advises against placing sensitive values in custom data. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/custom-data).

## Applicability

Use this review for a Linux image that actually uses cloud-init. Confirm the provisioning agent before applying its readiness behavior to another image. Identify the particular configuration or script whose completion the next deployment step depends on, rather than treating all first-boot work as one unnamed task.

## DSE recommendation

Define an explicit completion and failure signal for the custom-data task before allowing dependent deployment steps. Have the image owner specify the expected result, a bounded waiting policy, and the response to an unsuccessful run. Keep secrets out of the payload and review the retained troubleshooting output for unnecessary sensitive content. Make the dependency on successful configuration visible in the deployment design.

## Verification

In a permitted test, compare the VM’s platform-ready time with the custom-data task’s actual completion. Include a deliberately unsuccessful configuration case and confirm that the chosen signal prevents dependent work from proceeding. Inspect the resulting application configuration, not only the script’s last message. Preserve the payload version and observations so an image or provisioning-agent change can be tested against the same acceptance criteria.

## Official references

[Microsoft Learn: Custom data on Azure virtual machines](https://learn.microsoft.com/en-us/azure/virtual-machines/custom-data). Source reviewed September 9, 2026.

## Primary reference

- Name: Custom data on Azure virtual machines - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/custom-data
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Require a separate completion signal for cloud-init custom-data work,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-042-require-a-separate-completion-signal-for-cloud-init-custom-data-work/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.