Handling domain join reboots during VM Applications installation on Azure VMSS

Overview

I'm migrating from traditional VMs to Azure Virtual Machine Scale Sets (VMSS) using VM Applications for application deployment. The VMSS instances require domain-joining for enterprise compliance and DNS resolution, but I'm encountering a fundamental conflict between the domain join reboot and VM Applications execution flow.

The Problem Sequence

1. VM Applications install script starts execution
2. Script attempts domain join (Add-Computer -DomainName "domain.local")
3. Domain join triggers automatic reboot
4. VM Applications installation fails due to interruption by the reboot
5. VMSS instances end up in failed state - neither domain-joined nor application installed

Why Traditional Extensions Don't Work

CustomScriptExtensions (CSE)

• ❌ Create irrecoverable VMSS lock-out states when they fail
• ❌ "Chicken and egg" problem: If CSE fails, any VMSS update attempts run the old broken CSE first
• ❌ Requires complete resource recreation to recover

VM Applications

• ✅ Much better reliability and atomic rollback capabilities
• ❌ Currently can't handle reboots during installation

The Azure Solution (That We Can't Use)

Azure documentation shows a scriptBehaviorAfterReboot: "Rerun" property that should solve this exact problem by allowing VM Applications to resume after reboot.

The Issue: This feature is only available in:

• ✅ ARM templates (API version 2024-03-03)
• ❌ Azure CLI (not supported)
• ❌ Terraform (not supported)

Since we use Infrastructure as Code with Terraform, we can't leverage this solution.

Questions

How do others handle domain joining in VM Applications that require reboots?

Are there workarounds for the scriptBehaviorAfterReboot limitation in standard tooling?

Should I separate domain join from application installation into different deployment phases?

Are there alternatives to traditional domain join that work better with VMSS + VM Applications?

Environment Details

• OS: Windows Server 2022
• Platform: Azure VMSS with VM Applications
• Infrastructure: Terraform (Infrastructure as Code requirement)
• Network: Enterprise domain environment

Compliance: Domain join mandatory

Overview

I'm migrating from traditional VMs to Azure Virtual Machine Scale Sets (VMSS) using VM Applications for application deployment. The VMSS instances require domain-joining for enterprise compliance and DNS resolution, but I'm encountering a fundamental conflict between the domain join reboot and VM Applications execution flow.

The Problem Sequence

1. VM Applications install script starts execution
   1. Script attempts domain join (Add-Computer -DomainName "domain.local")
      1. Domain join triggers automatic reboot
         1. VM Applications installation fails due to interruption by the reboot
            1. VMSS instances end up in failed state - neither domain-joined nor application installed

Why Traditional Extensions Don't Work:

CustomScriptExtensions (CSE)

• ❌ Create irrecoverable VMSS lock-out states when they fail
• ❌ "Chicken and egg" problem: If CSE fails, any VMSS update attempts run the old broken CSE first
• ❌ Requires complete resource recreation to recover

VM Applications

• ✅ Much better reliability and atomic rollback capabilities
  • ❌ Currently can't handle reboots during installation

The Azure Solution (That We Can't Use)

Azure documentation shows a scriptBehaviorAfterReboot: "Rerun" property that should solve this exact problem by allowing VM Applications to resume after reboot.

The Issue: This feature is only available in:

• ✅ ARM templates (API version 2024-03-03)
  • ❌ Azure CLI (not supported)
    • ❌ Terraform (not supported)

Since we use Infrastructure as Code with Terraform, we can't leverage this solution.

Questions

• How do others handle domain joining in VM Applications that require reboots?
• Are there workarounds for the scriptBehaviorAfterReboot limitation in standard tooling?
• Should I separate domain join from application installation into different deployment phases?
• Are there alternatives to traditional domain join that work better with VMSS + VM Applications?
• OS: Windows Server 2022
• Platform: Azure VMSS with VM Applications
• Infrastructure: Terraform (Infrastructure as Code requirement)
• Network: Enterprise domain environment
• Compliance: Domain join mandatory

OS: Windows Server 2022

Platform: Azure VMSS with VM Applications

Infrastructure: Terraform (Infrastructure as Code requirement)

Network: Enterprise domain environment

Compliance: Domain join mandatory