# Attach the publishing identity to the gallery, not the destination VM

> Which identity reads a private application blob when an Azure VM Application version is published?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-102-attach-the-publishing-identity-to-the-gallery-not-the-destination-vm/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:30:14+00:00
- Modified: 2026-09-10T00:52:38+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Which identity reads a private application blob when an Azure VM Application version is published?

## Potentially affected

Publishers adopting managed-identity blob access for Azure Compute Gallery VM Application versions.

## DSE recommendation

Bind the package-reading identity and its storage role to the gallery's publishing workflow.

## Article

## Source facts

The documented VM Application publishing flow attaches a user-assigned identity to Compute Gallery and grants it Storage Blob Data Contributor access to the package’s storage account. Publication uses a plain blob URL rather than a SAS URL. If direct URL access lacks permission, the gallery falls back to its attached identity. This support applies to publishing, not deployment onto VMs or scale sets. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications-publish-with-managed-identity).

## Applicability

Identify the gallery, package blob, storage authorization, and identity used by publication. Keep destination-VM identity and application deployment permissions as separate subjects. Review the source’s trusted-service network behavior and supported management tools against the storage account’s actual restrictions before implementation.

## DSE recommendation

Bind the package-reading identity and its storage role to the gallery’s publishing workflow. Have the storage owner review the documented role scope and confirm that the intended identity is attached to the correct gallery. Remove the assumption that granting a role to a destination VM will solve a publication-time blob access problem. Keep authentication evidence free of SAS secrets.

## Verification

Publish a benign test package through the approved gallery using its plain blob URL and inspect the actual result. Check identity assignment and storage access when publication fails before broadening anonymous access or generating a replacement SAS. Then verify application deployment separately using its own supported path. Retain the publisher identity, gallery ID, blob identity, and distinct publish/deploy outcomes without conflating the two authorization stages.

## Official references

[Microsoft Learn: Publish VM Applications using managed identity](https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications-publish-with-managed-identity). Source reviewed September 9, 2026.

## Primary reference

- Name: Publish VM applications using managed identity - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications-publish-with-managed-identity
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Attach the publishing identity to the gallery, not the destination VM,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-102-attach-the-publishing-identity-to-the-gallery-not-the-destination-vm/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.