Azure Virtual Desktop: Custom Image Template Fails with PowerShell Script in Azure VM Image Builder

Question

Azure Virtual Desktop: Custom Image Template Fails with PowerShell Script in Azure VM Image Builder

Casey Hansen (SA) 0

Problem description

I am creating an Azure Virtual Desktop custom image template using Azure VM Image Builder. The process fails when I include a PowerShell customizer script stored in Azure Storage and referenced by URL. The error reported is a generic internal failure: 'Internal error occurred. This is a generic error. To identify possible causes, go to https://aka.ms/azvmimagebuilderts.' When I remove the custom script, the template creation succeeds.

Environment

Azure VM Image Builder for Azure Virtual Desktop, using a PowerShell script hosted in Azure Storage with access control via RBAC. The storage account has both private endpoint and public access enabled with anonymous blob access for the container.

What I've already tried

I tested the template with the PowerShell customizer script included and removed. When included, template creation fails; when removed, it succeeds. I verified that the script URI points directly to the blob file and that the SAS URL is correctly formatted. I attempted using a SAS token with read-only permissions and a short expiry. I also confirmed that the storage account allows anonymous access and that the URL works in a browser. I reviewed the guidance on storage SAS, network access, and template configuration. I checked that the build VM can reach the storage endpoint and that the script URL is not a container or portal link. I verified the storage account's network rules and SAS token permissions.

Current status

The template only succeeds when the storage account is publicly accessible with anonymous blob access enabled. Using a SAS URL does not resolve the issue. The root cause appears to be that VM Image Builder cannot reach the script blob with the current access settings, possibly due to network restrictions or incorrect script URL formatting. I am seeking guidance on how to configure the storage and script URL properly to enable successful template creation without making the storage account fully public.

Manasa Akula 775 Reputation points Microsoft External Staff Moderator

2026-09-15T04:47:47.5966667+00:00
Dear Casey Hansen (SA),

Thank you for sharing the troubleshooting details.

Based on the test results, the image template is failing when Azure VM Image Builder attempts to retrieve or execute the PowerShell script. Please note that a SAS token provides blob authorisation only; it does not bypass storage account network restrictions.

For the Azure Virtual Desktop custom image template workflow, Microsoft documentation states that the script URI must be reachable from a publicly available location. You can therefore keep the container private without enabling anonymous blob access by using the following configuration:

Disable anonymous access on the blob container.

Keep the storage account public network endpoint reachable during the build.

Generate a blob-level** HTTPS SAS **URL with Read permission and an expiry long enough to cover the complete image build.

Confirm that the URL points directly to the .ps1 file, for example:
https://<account>.blob.core.windows.net/<container>/<script>.ps1?<SAS-token>

Recreate the template with the complete SAS URL, including the query string.

If your security requirement is to disable the storage account’s public network access completely, please use Azure VM Image Builder with an existing virtual network instead of relying on the AVD custom image template’s public script-URI workflow. The build VM must be connected to a VNet that can reach the storage private endpoint, and the storage account hostname must resolve through the private DNS zone privatelink.blob.core.windows.net.

If the build still fails, please review the customization.log file in the packerlogs container of the staging resource group. This log will confirm whether the failure is caused by downloading the script or by the script returning a non-zero exit code. Azure VM Image Builder requires custom scripts to complete without prompting for input and normally return exit code 0.

Microsoft documentation:

Troubleshoot custom image templates in Azure Virtual Desktop

Troubleshoot Azure VM Image Builder

Use Azure VM Image Builder with an existing virtual network

Create a Windows VM using Azure VM Image Builder

Kindly test the private-container SAS configuration and share the relevant customization.log entries if the issue continues.

Regards,

Manasa.

1 answer

Your answer

Answer 1

Hi Casey Hansen (SA) & thx for join me at Q&A platform,

fact that the build succeeds only when anonymous blob access is enabled strongly suggests that the failure is occurring while Azure VM Image Builder retrieves the PowerShell script, not while the script itself executes.

For AVD Custom Image Templates, the supported way to keep the blob private is to use the managed identity selected for the image template and grant that identity Storage Blob Data Reader on the script container or blob. Microsoft explicitly documents this for custom scripts stored in Azure Storage. Microsoft Learn I would prefer that over SAS; current Image Builder guidance also recommends managed identity rather than embedding SAS credentials in scriptUri.

There is a second, separate issue if the Storage account has network restrictions. A SAS only handles authorization; it doesn't bypass the Storage firewall or private-endpoint routing. For firewall-protected Storage, current Image Builder networking guidance requires the appropriate build/ACI subnet topology and Storage network access from that path. So a URL working in your browser doesn't prove that the Image Builder service can retrieve it.

I’d also check customization.log rather than relying on the generic Internal error occurred message. The failed build's IT_<resource-group><template>... staging resource group contains the packerlogs container, and the log should show whether retrieval is returning 403, failing DNS/network connectivity, or failing later during PowerShell execution.

So I wouldn't enable anonymous blob access as the permanent workaround. Use a private container, grant the template's UAMI Storage Blob Data Reader, use the normal blob URI without a SAS, and then make sure the Image Builder network path is permitted by the Storage account. If that exact configuration still returns an internal error while customization.log shows the identity successfully reaching Storage, then it becomes an Azure VM Image Builder issue worth escalating with the build operation ID and log.

rgds,

Alex