# Keep UDF support when cloud-init provisioning needs passwords or custom data

> Can an Azure Linux image drop its UDF driver without changing the provisioning inputs it accepts?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-584-keep-udf-support-when-cloud-init-provisioning-needs-passwords-or-custom-data/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:22:12+00:00
- Modified: 2026-09-10T02:14:31+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

Can an Azure Linux image drop its UDF driver without changing the provisioning inputs it accepts?

## Potentially affected

Linux image maintainers evaluating the documented cloud-init provisioning path in Azure.

## DSE recommendation

List the required provisioning inputs before deciding to remove UDF support from an image.

## Article

## Source facts

From cloud-init 21.2, Azure provisioning can use Instance Metadata Service when the image lacks a UDF driver. That route supports SSH keys and user data, but passwords and custom data still require UDF. Microsoft also distinguishes support for a cloud-init package from an image already configured to provision with it. An available package alone is therefore not the complete image-readiness check. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/linux/using-cloud-init).

## Applicability

Use this review for custom Linux images and changes to their kernel or provisioning components. Identify which deployment workflows provide passwords, custom data, SSH keys, or user data, rather than treating all boot-time inputs as equivalent.

## DSE recommendation

List the required provisioning inputs before deciding to remove UDF support from an image. Ask the image owner to compare the intended driver change against actual deployment parameters. Keep a documented decision for each consumer: preserve the required input path or explicitly redesign that consumer’s provisioning contract. Avoid silently substituting user data for custom data simply to make a reduced image boot.

## Verification

Build a disposable VM from the candidate image with the intended input combination. Check that the expected account configuration and application setup actually appear, and inspect provisioning logs when they do not. Include a workflow representative of any password or custom-data dependency. Retain the image version and sanitized input categories with the result; never capture passwords or secret-bearing payloads as test evidence.

## Official references

[Microsoft Learn: cloud-init support for virtual machines in Azure](https://learn.microsoft.com/en-us/azure/virtual-machines/linux/using-cloud-init). Source reviewed September 9, 2026.

## Primary reference

- Name: Overview of cloud-init support for Linux VMs in Azure - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/linux/using-cloud-init
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep UDF support when cloud-init provisioning needs passwords or custom data,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-584-keep-udf-support-when-cloud-init-provisioning-needs-passwords-or-custom-data/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.