Attach the publishing identity to the gallery, not the destination VM

Source facts

The documented VM Application publishing flow attaches a user-assigned identity to Compute Gallery and grants it Storage Blob Data Contributor access to the package’s storage account. Publication uses a plain blob URL rather than a SAS URL. If direct URL access lacks permission, the gallery falls back to its attached identity. This support applies to publishing, not deployment onto VMs or scale sets. Microsoft Learn.

Applicability

Identify the gallery, package blob, storage authorization, and identity used by publication. Keep destination-VM identity and application deployment permissions as separate subjects. Review the source’s trusted-service network behavior and supported management tools against the storage account’s actual restrictions before implementation.

DSE recommendation

Bind the package-reading identity and its storage role to the gallery’s publishing workflow. Have the storage owner review the documented role scope and confirm that the intended identity is attached to the correct gallery. Remove the assumption that granting a role to a destination VM will solve a publication-time blob access problem. Keep authentication evidence free of SAS secrets.

Verification

Publish a benign test package through the approved gallery using its plain blob URL and inspect the actual result. Check identity assignment and storage access when publication fails before broadening anonymous access or generating a replacement SAS. Then verify application deployment separately using its own supported path. Retain the publisher identity, gallery ID, blob identity, and distinct publish/deploy outcomes without conflating the two authorization stages.

Official references

Microsoft Learn: Publish VM Applications using managed identity. Source reviewed September 9, 2026.