Check action Run Command's result path before repeating a Windows repair

Source facts

Windows action Run Command needs outbound connectivity on port 443 to Azure public endpoints to return script results. If that path is unavailable, a script can succeed without returning its result. The feature also requires a ready VM agent. Microsoft identifies the guest’s RunCommandExtension.log as a troubleshooting source. Microsoft Learn.

Applicability

Use this distinction when the action interface provides no usable result after an attempted repair. Identify the exact command, target VM, submission time, agent state, and expected guest change. Keep this transport investigation separate from interpreting a managed Run Command resource’s execution status.

DSE recommendation

Establish the guest-side outcome and result-return path before repeating a state-changing command. Have the VM owner inspect available local evidence through an authorized access path and the network owner review the required outbound route. Do not assume the repair was never applied merely because its response is missing. Propose only the connectivity adjustment justified by the documented endpoint requirement and local policy.

Verification

First use a benign diagnostic with an independently observable guest result. Compare the guest observation and extension log with what the action interface returns. After an approved network correction, repeat the diagnostic and verify both execution and returned output. Before retrying the original repair, reconcile the current guest state with the intended change and obtain the appropriate change approval. If guest evidence remains unavailable, preserve that uncertainty rather than guessing whether execution occurred.

Official references

Microsoft Learn: Run scripts in your Windows VM by using action Run Commands. Source reviewed September 9, 2026.