Question

Your company is standardizing session host images using Azure VM Image Builder (AIB). The build template must download configuration scripts from an existing Azure Storage account (blob container) during the customization phase and then distribute the finished image to an Azure Compute Gallery. The security team refuses to allow AIB to use a service principal with stored credentials. What is the correct approach to grant Image Builder the permissions it needs?

Accepted Answer

Create a user-assigned managed identity, assign it to the image template, and grant it the Storage Blob Data Reader role on the storage account and appropriate contributor rights on the Compute Gallery resource group.

Answer

Enable the system-assigned managed identity on each session host VM and grant those identities read access to the storage account.

Answer

Generate a SAS token for the blob container with a 90-day expiry and embed it directly in the AIB customization step.

Answer

Add the Azure Image Builder first-party service principal to the Owner role on the subscription so it can access all resources.