Include temporary ACI resources in an isolated Image Builder readiness review

Source facts

Azure Image Builder’s isolated-build design runs major customization and validation work in Azure Container Instances within the customer’s subscription. Microsoft requires registration of Microsoft.ContainerInstance, sufficient ACI quota, and policy that permits those resources. Depending on network topology, temporary virtual networks, network security groups, and private endpoints may also be required. These temporary resources exist during the build and are removed afterward. Microsoft Learn.

Applicability

Review the actual image template and staging resource group, including its selected subnet topology. Check the current rollout and networking guidance rather than assuming identical temporary resources in every location. Distinguish the build infrastructure from the contents of the final image.

DSE recommendation

Review the staging resource group’s permitted temporary resource types and ACI capacity before starting the build. Ask the policy owner to inspect resource-type restrictions and networking requirements with the image team. Resolve a legitimate design conflict through a narrowly approved change or supported topology, not a subscription-wide policy bypass. Record which resources are expected to appear and disappear during the run.

Verification

Observe an authorized test build and compare its staging resources with the approved topology. If creation fails, retain the denied resource type or quota evidence before altering the image’s customization script. Review the build logs and final image validation separately from infrastructure provisioning. Confirm that expected temporary resources are cleaned up, and investigate unexplained survivors without deleting the staging group’s retained evidence indiscriminately.

Official references

Microsoft Learn: Isolated Image Builds for Azure VM Image Builder. Source reviewed September 9, 2026.