Share via

Create or Update Virtual Machine Extension Failed

Pranab Nath 0 Reputation points
2025-04-23T08:04:45.91+00:00

Can you please help on this issue "Create or Update Virtual Machine Extension"?

  • Resource/subscriptions/d9bfd93a-a9f4-453c-8b6f-b3c85bcdc54c/resourcegroups/FPS_SERVER/providers/Microsoft.Compute/virtualMachines/FpsSteveServer/extensions/MDE.Linux
  • Operation nameCreate or Update Virtual Machine Extension
  • Time stampWed Apr 23 2025 04:27:56 GMT+0100 (British Summer Time)
  • Event initiated by Windows Azure Security Resource Provider
  • Error codeResourceOperationFailure
  • MessageThe resource operation completed with terminal provisioning state 'Failed'.
Azure Virtual Machines
Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
8,760 questions

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Alex Burlachenko 4,875 Reputation points
    2025-04-25T12:54:15.02+00:00

    Dear Pranab Nath,

    Thank you for reaching out regarding the issue with the Virtual Machine Extension. I understand you’re encountering a failure when attempting to create or update the MDE.Linux extension on the virtual machine FpsSteveServer.

    Check the Activity Log or Azure Monitor logs in the Azure Portal for more detailed error messages related to this operation. This can often provide clues about the root cause (e.g., permissions, network issues, or resource constraints).

    Ensure the MDE.Linux extension is compatible with the OS version and VM configuration. Cross-check the Microsoft Defender for Endpoint (MDE) documentation for prerequisites.

    Confirm the VM (FpsSteveServer) is running and accessible. Sometimes, extensions fail to deploy if the VM is in a stopped or problematic state.

    Ensure the account or service principal initiating the operation has the required permissions (e.g., Microsoft.Compute/virtualMachines/extensions/write).

    Transient issues (e.g., network timeouts) can cause failures. Retry the deployment after a few minutes.

    If the Azure extension continues to fail, consider manually installing the MDE agent on the Linux VM using the manual deployment instructions.

    If the issue persists, please share еhe full error logs (from Azure Portal > Virtual Machine > Extensions > Failed Deployment). The OS version of the VM. Any recent changes to the VM’s network/firewall settings.

    p.s. https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually

    best regards,

    Alex

    P.S. If my answer help to you, please Accept my answer
    0 comments
  2. Pranab Nath 0 Reputation points
    2025-05-07T15:57:40.11+00:00

    Hi

    The following commands ran successfully, yet "UpgradeVMExtensions" continues to fail:

    fpsSkdSteveServer@FpsSteveServer:~$ mdatp health --field real_time_protection_enabled

    true

    fpsSkdSteveServer@FpsSteveServer:~$ mdatp health --field definitions_status

    "up_to_date"

    fpsSkdSteveServer@FpsSteveServer:~$ mdatp health --field healthy

    true

  3. Arko 2,210 Reputation points Microsoft External Staff
    2025-05-08T11:33:26.0066667+00:00

    Hello Pranab Nath,

    I faced the exact same issue end-to-end in a fresh environment and was able to identify the root cause.
    pranab1 In your case, Microsoft Defender for Endpoint (mdatp) was already manually installed and running correctly on the VM, but Azure is still trying to apply or upgrade the MDE.Linux VM extension. Since the extension expects to handle onboarding and configuration itself, it fails when it detects that the agent is already active or the expected configuration isn’t available. That’s why you keep seeing provisioning errors like exit code: 53 or SubmissionFailed even though mdatp health shows everything is up to date and healthy.

    pranab2

    This situation creates a conflict between the manually installed agent and the extension-based deployment that Azure is still attempting. The clean fix is to simply remove the stale or failed MDE.Linux extension from the VM. This will stop Azure from retrying the extension deployment and won’t impact the functioning of the Defender agent that you installed manually.

    You can run the following command to remove the extension

    
az vm extension delete \

  --name "MDE.Linux" \

  --vm-name "FpsSteveServer" \

  --resource-group "FPS_SERVER"

    pranab3

    After that, there’s nothing more you need to do, as your manual installation is already working and reporting healthy. If you’re managing Defender manually across your fleet, you might also want to disable automatic extension deployment via Defender for Cloud policy to avoid similar conflicts in the future.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.