# Read the managed Run Command script result separately from provisioning status

> Can a managed Run Command resource provision successfully while the Windows script itself fails?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-332-read-the-managed-run-command-script-result-separately-from-provisioning-status/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:26:24+00:00
- Modified: 2026-09-10T01:40:03+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

Can a managed Run Command resource provision successfully while the Windows script itself fails?

## Potentially affected

Windows Azure VMs using managed Run Command resources through CLI, PowerShell, or API.

## DSE recommendation

Require the script's execution state and exit code in completion evidence, with deployment-failure propagation chosen explicitly.

## Article

## Source facts

Managed Run Command distinguishes extension provisioning from the script’s execution result. The expanded instance view exposes execution state, exit code, output, and error; a nonzero exit code indicates failure. With treatFailureAsDeploymentFailure set false, provisioning status does not report script failure. API version 2023-03-01 introduced the option to set that property true and fail deployment when the script fails. Instance-view output and error retain only their final 4 KB. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-command-managed).

## Applicability

Use this acceptance check for managed Run Command on Windows VMs, not merely the original action-oriented command interface. Identify the exact named command resource and whether the caller expects script failure to fail the surrounding deployment. Keep transport or provisioning success separate from the application’s intended result.

## DSE recommendation

Require the script’s execution state and exit code in completion evidence, with deployment-failure propagation chosen explicitly. Have the script owner document meaningful failure exits and any output that must be retained beyond the instance-view tail. Avoid declaring a repair complete from a successful resource deployment alone.

## Verification

Run a benign success case and a deliberately failing case on a disposable VM. For each, compare provisioning state, expanded execution state, exit code, and the deployment result under the selected setting. Inspect the script’s actual target condition separately. Retain the exact command identity and terminal result so later cleanup or another execution cannot be mistaken for the run being reviewed.

## Official references

[Microsoft Learn: Managed Run Command for Windows](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-command-managed). Source reviewed September 9, 2026.

## Primary reference

- Name: Run scripts in a Windows VM in Azure using managed Run Commands - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-command-managed
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Read the managed Run Command script result separately from provisioning status,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-332-read-the-managed-run-command-script-result-separately-from-provisioning-status/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.