Treat VM user data as mutable shared metadata rather than a secret delivery channel

Source facts

Azure VM user data remains available through the VM’s lifetime and can be changed externally without stopping or rebooting it. Applications retrieve it through IMDS, and any process on the VM can query it. Microsoft warns that user data is not encrypted and must not contain confidential information. An update containing an empty userData string deletes the data; custom data is not retrievable through IMDS. Microsoft Learn.

Applicability

Use this review for an application intentionally consuming user data, not for assuming a startup script automatically reruns when metadata changes. Identify the approved writer, consuming process, schema, and required update behavior. Keep credentials and sensitive configuration outside this channel.

DSE recommendation

Define a nonsecret metadata schema and an explicit application response to changes or removal. Ask the application owner to specify validation, version handling, and the safe response to a missing value. Have the deployment owner review the exact update payload so an empty string is not used accidentally as a harmless placeholder. Separate a successful metadata update from evidence that the application applied it.

Verification

On a test VM, retrieve a benign value, change it through the authorized management path, and observe the consumer’s actual behavior without assuming a restart. Exercise an invalid payload and intentional removal, checking the application’s agreed fallback. Retain sanitized schema and version evidence rather than metadata contents that might later become sensitive. Record collection, validation, and application outcomes separately.

Official references

Microsoft Learn: User Data for Azure Virtual Machine. Source reviewed September 9, 2026.