Publish a Machine Configuration package with matching URI and content hash

Source facts

Microsoft’s custom Machine Configuration policy lifecycle requires the contentHash to match the published ZIP file. New-GuestConfigurationPolicy updates that hash automatically. Changing only contentUri causes the extension to reject the package. The source also calls for a higher policy version and recommends a versioned package filename. Microsoft Learn.

Applicability

Apply this review to a new release of an existing custom Machine Configuration package. Identify the generated definition, package artifact and publication location. Keep artifact identity separate from whether the configuration itself is appropriate for the intended machines.

DSE recommendation

DSE recommends recording the policy version, package URI and hash together as one release record. Generate the definition from the approved package, then have another reviewer compare the published artifact with that record. Preserve the prior package and definition for a controlled reversal. Avoid overwriting an artifact while retaining metadata that describes different content.

Verification

Read the published package back through the intended access path and compare its digest with the policy’s declared hash. Apply the release to an approved test machine and inspect the assignment’s resulting evidence. Confirm that the intended package is evaluated before extending scope. If download or hash validation fails, resolve the artifact mismatch before changing the configuration logic.

Official references

Microsoft Learn: How to create custom machine configuration policy definitions.