Review Azure VM extension operations

Description

VM extensions can install software and perform management tasks with elevated privileges. Allowing extension operations lets authorized management identities use this capability, so control it according to need. This setting does not grant execution rights to anonymous users.

Potential impact

Excessive management permissions or untrusted extensions can affect VM configuration and data.
Disabling extensions without checking dependencies can interrupt security, monitoring or backup functions.

Remediation

Identify required extensions and dependencies. If extensions are not needed, consider allow_extension_operations = false or the resource-specific extension_operations_enabled = false.
Where extensions are required, minimize deployment and modification permissions and use approved publishers and extensions. Review changes and extension health.

Examples

These Linux VM excerpts compare only extension operations. Supply omitted OS-disk, image and administrator-authentication settings separately.

Before

hcl

resource "azurerm_linux_virtual_machine" "example" {
  name                = "example-vm"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  size                = "Standard_F2"
  admin_username      = "adminuser"
  network_interface_ids = [azurerm_network_interface.example.id]

  allow_extension_operations = true
}

After

hcl

resource "azurerm_linux_virtual_machine" "example" {
  name                = "example-vm"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  size                = "Standard_F2"
  admin_username      = "adminuser"
  network_interface_ids = [azurerm_network_interface.example.id]

  allow_extension_operations = false
}

Explanation:

Before: Extension operations are allowed. Management permissions and extension trust require separate controls.
After: Extension operations are not allowed. First check the impact on required operational functions.