# Publish a Machine Configuration package with matching URI and content hash

> Keep policy metadata aligned with the exact package artifact.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-045-publish-a-machine-configuration-package-with-matching-uri-and-content-hash/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:15+00:00
- Modified: 2026-09-17T16:35:04+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Keep policy metadata aligned with the exact package artifact.

## Potentially affected

Apply this review to a new release of an existing custom Machine Configuration package. Identify the generated definition, package artifact and publication location. Keep artifact identity separate from whether the configuration itself is appropriate for the intended machines.

## DSE recommendation

DSE recommends recording the policy version, package URI and hash together as one release record.

## Article

## Source facts

Microsoft’s custom Machine Configuration policy lifecycle requires the contentHash to match the published ZIP file. New-GuestConfigurationPolicy updates that hash automatically. Changing only contentUri causes the extension to reject the package. The source also calls for a higher policy version and recommends a versioned package filename. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/create-policy-definition).

## Applicability

Apply this review to a new release of an existing custom Machine Configuration package. Identify the generated definition, package artifact and publication location. Keep artifact identity separate from whether the configuration itself is appropriate for the intended machines.

## DSE recommendation

DSE recommends recording the policy version, package URI and hash together as one release record. Generate the definition from the approved package, then have another reviewer compare the published artifact with that record. Preserve the prior package and definition for a controlled reversal. Avoid overwriting an artifact while retaining metadata that describes different content.

## Verification

Read the published package back through the intended access path and compare its digest with the policy’s declared hash. Apply the release to an approved test machine and inspect the assignment’s resulting evidence. Confirm that the intended package is evaluated before extending scope. If download or hash validation fails, resolve the artifact mismatch before changing the configuration logic.

## Official references

[Microsoft Learn: How to create custom machine configuration policy definitions](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/create-policy-definition).

## Primary reference

- Name: How to create custom machine configuration policy definitions - Azure Machine Configuration | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/create-policy-definition
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Publish a Machine Configuration package with matching URI and content hash,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-045-publish-a-machine-configuration-package-with-matching-uri-and-content-hash/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.