# Use an explicit rerun signal when a scale-set extension's script URI stays unchanged

> How can a scale-set extension be rerun when its script content changes but its configuration URI does not?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-434-use-an-explicit-rerun-signal-when-a-scale-set-extension-s-script-uri-stays/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:24:42+00:00
- Modified: 2026-09-10T02:04:57+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

How can a scale-set extension be rerun when its script content changes but its configuration URI does not?

## Potentially affected

Owners maintaining application extensions on existing Azure scale sets, with procedures matched to orchestration mode.

## DSE recommendation

Record the intended script revision and an explicit extension-rerun decision together.

## Article

## Source facts

Microsoft documents forceUpdateTag for rerunning a scale-set extension even when its ordinary configuration is unchanged, such as revised script contents at the same URI. Azure does not interpret the tag’s value as instructions; changing it triggers rerun. This mechanism is available to extensions generally, not only Custom Script. Extension-configuration updates follow the scale set’s upgrade policy. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-upgrade-scale-set).

## Applicability

Use this review when a deployment workflow publishes a new payload without changing the configured source address. The source notes that many procedures target Uniform orchestration, so confirm the management path for the actual scale set before applying a model change.

## DSE recommendation

Record the intended script revision and an explicit extension-rerun decision together. Have the deployment owner connect the rerun request to a specific reviewed payload and the intended instance population. Check that repeating the extension’s work is acceptable for the application. Keep the tag’s purpose explicit rather than treating its text as an argument that changes how the script executes.

## Verification

In a controlled rollout, compare extension execution evidence with the intended payload revision on representative instances. Confirm the configured upgrade policy has reached the planned population before declaring completion. Preserve any instances that remain pending or failed as unresolved work. A changed tag in the desired model should not substitute for proof that the intended application operation actually ran.

## Official references

[Microsoft Learn: Modify a Virtual Machine Scale Set](https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-upgrade-scale-set). Source reviewed September 9, 2026.

## Primary reference

- Name: Modify an Azure Virtual Machine Scale Set - Azure Virtual Machine Scale Sets | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-upgrade-scale-set
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Use an explicit rerun signal when a scale-set extension's script URI stays unchanged,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-434-use-an-explicit-rerun-signal-when-a-scale-set-extension-s-script-uri-stays/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.