Vm/VMSS Support UseLocalFileRules Parameter

[huiminyan2017]

Preconditions

• Need 2026-04-01 Python SDK release, ETA: (2026-07-29).

Related command

az vm create
az vm update
az vmss create
az vmss update

Resource Provider

Microsoft.Compute/VirtualMachines

Description of Feature or Work Requested

Feature: https://learn.microsoft.com/en-us/azure/virtual-machines/metadata-security-protocol/overview

User can opt-in the Azure metadata security protocol (MSP) for their VM and VMSS and enforce access control using rules at a defined path inside the VM, thus their VM can be protected from SSRF and Scorpin heart attack to IMDS and WireServer endpoints.

Add a new parameter --wire-server-use-local-file-rules for vm/vmss create/update:

az vm create --wire-server-use-local-file-rules
az vm update --wire-server-use-local-file-rules {false, true}
az vmss create --wire-server-use-local-file-rules
az vmss update --wire-server-use-local-file-rules {false, true}

Minimum API Version Required

2026-04-01(SDK)

Swagger PR link / SDK link

Azure/azure-rest-api-specs#36669

Request Example

{
  "parameters": {
    "subscriptionId": "{subscription-id}",
    "resourceGroupName": "myResourceGroup",
    "vmName": "myVM",
    "api-version": "2025-04-01",
    "parameters": {
      "location": "westus",
      "properties": {
        "hardwareProfile": {
          "vmSize": "Standard_D2s_v3"
        },
        "securityProfile": {
          "proxyAgentSettings": {
            "enabled": true,
            "wireServer": {
              "mode": "Audit",
              "useLocalFileRules": true
            },
            "imds": {
              "mode": "Audit",
              "useLocalFileRules": true
            }
          }
        },
        "storageProfile": {
          "imageReference": {
            "publisher": "MicrosoftWindowsServer",
            "offer": "WindowsServer",
            "sku": "2019-Datacenter",
            "version": "latest"
          },
          "osDisk": {
            "caching": "ReadOnly",
            "managedDisk": {
              "storageAccountType": "StandardSSD_LRS"
            },
            "createOption": "FromImage",
            "name": "myVMosdisk"
          }
        },
        "osProfile": {
          "adminUsername": "{your-username}",
          "computerName": "myVM",
          "adminPassword": "{your-password}"
        },
        "networkProfile": {
          "networkInterfaces": [
            {
              "id": "/subscriptions/{subscription-id}/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkInterfaces/{existing-nic-name}",
              "properties": {
                "primary": true
              }
            }
          ]
        }
      }
    }
  }

Target Date

2026-09-01

PM Contact

kaisulkin

Engineer Contact

huiya

Additional context

How to test:
// Create a new VM;

set resourceGroupName="huiya-eastus2euap"
set locationName="WestUS2"
set vmName="vm2"
set adminPassword="your password"
az login
az vm create -g %resourceGroupName% --location %locationName% --image Canonical:0001-com-ubuntu-server-jammy:22_04-lts:latest --size Standard_D2s_v5 --admin-username test_admin --admin-password %adminPassword% --enable-proxy-agent --add-proxy-agent-extension --name %vmName% --wire-server-mode Audit --wire-server-use-local-file-rules --imds-mode Audit --imds-use-local-file-rules

[yonzhan]

Thank you for opening this issue, we will look into it.