# Include temporary ACI resources in an isolated Image Builder readiness review

> Can subscription policy or quota block an image build even when the image template is unchanged?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-081-include-temporary-aci-resources-in-an-isolated-image-builder-readiness-review/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:30:35+00:00
- Modified: 2026-09-10T00:35:08+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Checklist
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Can subscription policy or quota block an image build even when the image template is unchanged?

## Potentially affected

Subscription and image owners evaluating Azure VM Image Builder's isolated-build infrastructure.

## DSE recommendation

Review the staging resource group's permitted temporary resource types and ACI capacity before starting the build.

## Article

## Source facts

Azure Image Builder’s isolated-build design runs major customization and validation work in Azure Container Instances within the customer’s subscription. Microsoft requires registration of Microsoft.ContainerInstance, sufficient ACI quota, and policy that permits those resources. Depending on network topology, temporary virtual networks, network security groups, and private endpoints may also be required. These temporary resources exist during the build and are removed afterward. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/security-isolated-image-builds-image-builder).

## Applicability

Review the actual image template and staging resource group, including its selected subnet topology. Check the current rollout and networking guidance rather than assuming identical temporary resources in every location. Distinguish the build infrastructure from the contents of the final image.

## DSE recommendation

Review the staging resource group’s permitted temporary resource types and ACI capacity before starting the build. Ask the policy owner to inspect resource-type restrictions and networking requirements with the image team. Resolve a legitimate design conflict through a narrowly approved change or supported topology, not a subscription-wide policy bypass. Record which resources are expected to appear and disappear during the run.

## Verification

Observe an authorized test build and compare its staging resources with the approved topology. If creation fails, retain the denied resource type or quota evidence before altering the image’s customization script. Review the build logs and final image validation separately from infrastructure provisioning. Confirm that expected temporary resources are cleaned up, and investigate unexplained survivors without deleting the staging group’s retained evidence indiscriminately.

## Official references

[Microsoft Learn: Isolated Image Builds for Azure VM Image Builder](https://learn.microsoft.com/en-us/azure/virtual-machines/security-isolated-image-builds-image-builder). Source reviewed September 9, 2026.

## Primary reference

- Name: Isolated Image Builds for Azure VM Image Builder - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/security-isolated-image-builds-image-builder
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Include temporary ACI resources in an isolated Image Builder readiness review,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-081-include-temporary-aci-resources-in-an-isolated-image-builder-readiness-review/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.