Include Image Builder's staging resource group in the image trust boundary

Source facts

Azure VM Image Builder customizes images in a staging resource group within the subscription. Microsoft warns that access to this group can enable interference with the build, access to delegated template/build identities, and inspection of copied customizer artifacts. Template access separately permits running, deleting, or tampering with the template and changing the images it creates. Microsoft Learn.

Applicability

Use this review when defining image-pipeline permissions or investigating who could affect a produced image. Identify the actual staging group and the identities and artifacts used by its template rather than reviewing only the distribution gallery.

DSE recommendation

Review staging-group access as part of the image production approval, not as disposable infrastructure access. Ask the image and identity owners to explain every principal’s need for access across the build path. Restrict staging access to the required operators and automation, and compare the identities’ permissions with the specific build inputs and outputs. Review any broad troubleshooting grant before a build proceeds and document its intended duration and removal.

Verification

Inspect effective access on the staging group, template, and associated identities together. Confirm that an approved test operator can perform the intended build task without receiving unrelated privileges. Preserve sanitized permission evidence and the resulting artifact identity. When reviewing an unexpected image change, include staging activity and customizer provenance in the investigation rather than treating a restricted final gallery as proof that the build was protected.

Official references

Microsoft Learn: Best practices for Azure VM Image Builder. Source reviewed September 9, 2026.