title: Azure VM Scaleset custom script extension not working - possibly failing to get VM identity?
body: <p>I'm attempting to deploy to my Virtual machine scale set using the custom script extension as below.</p>
  <pre><code>az vmss extension set --debug --name 'CustomScriptExtension' `
      --resource-group 'my-rg' `
      --publisher 'Microsoft.Compute'  `
      --version '1.9.5' `
      --vmss-name 'myvmss' `
      --settings '{\&quot;commandToExecute\&quot;: \&quot;powershell.exe ./download-package.ps1\&quot;, \&quot;fileUris\&quot;: [\&quot;https://[REDACTED].blob.core.windows.net/upload/download-package.ps1\&quot;]}' `
      --protected-settings '{\&quot;managedIdentity\&quot;: {\&quot;objectId\&quot;: \&quot;[REDACTED]\&quot;}}'
  </code></pre>
  <p>When running I get the following error:</p>
  <blockquote>
  <p>cli.azure.cli.core.azclierror : Deployment failed. Correlation ID: 73f4d16b-afe0-4373-8773-1d7dd7d26940. VM has reported a failure when processing extension 'CustomScriptExtension'. Error message: &quot;Failed to download all specified files. Exiting. Error Message: Exception of type 'Microsoft.WindowsAzure.GuestAgent.Plugins.CustomScriptHandler.Downloader.MsiNotFoundException' was thrown.&quot;</p>
  </blockquote>
  <blockquote>
  <p>More information on troubleshooting is available at <a href="https://aka.ms/VMExtensionCSEWindowsTroubleshoot" rel="nofollow noreferrer">https://aka.ms/VMExtensionCSEWindowsTroubleshoot</a>
  Deployment failed. Correlation ID: 73f4d16b-afe0-4373-8773-1d7dd7d26940. VM has reported a failure when processing extension 'CustomScriptExtension'. Error message: &quot;Failed to download all specified files. Exiting. Error Message: Exception of type 'Microsoft.WindowsAzure.GuestAgent.Plugins.CustomScriptHandler.Downloader.MsiNotFoundException' was thrown.&quot;</p>
  </blockquote>
  <p>The file to be downloaded requires authentication so I have given the scale set a system assigned identity and granted it the <code>Storage Blob Data Reader</code> role on the storage account hosting the powershell file.</p>
  <p>The custom extension logs on the VM suggest that it was unable to get the identity of the vm:</p>
  <pre><code>[7108+00000001] [11/20/2020 09:12:28.79] [INFO] Handler successfully enabled
  [7108+00000001] [11/20/2020 09:12:28.80] [INFO] Loading configuration for sequence number 1
  [7108+00000001] [11/20/2020 09:12:28.84] [INFO] HandlerSettings = ProtectedSettingsCertThumbprint: [REDACTED], ProtectedSettings: {[REDACTED]}, PublicSettings: {FileUris: [https://[REDACTED].blob.core.windows.net/upload/download-package.ps1], CommandToExecute: powershell.exe ./download-package.ps1}
  [7108+00000001] [11/20/2020 09:12:29.26] [INFO] Downloading files specified in configuration...
  [7108+00000001] [11/20/2020 09:12:30.90] [INFO] Attempting to get MSI from IMDS
  [7108+00000001] [11/20/2020 09:12:31.04] [WARN] WebClient: non retryable error occurred System.Net.WebException: The remote server returned an error: (400) Bad Request.
     at System.Net.WebClient.DownloadDataInternal(Uri address, WebRequest&amp; request)
     at System.Net.WebClient.DownloadString(Uri address)
     at Microsoft.WindowsAzure.GuestAgent.Plugins.MsiUtils.WebClient.&lt;&gt;c__DisplayClass3_0.&lt;DownloadStringWithRetries&gt;b__0()
     at Microsoft.WindowsAzure.GuestAgent.Plugins.MsiUtils.WebClientWithRetryAbstract.ActionWithRetries(Action action)
  [7108+00000001] [11/20/2020 09:12:31.14] [ERROR] Unknown exception occurred while attempting to get MSI token System.Net.WebException: The remote server returned an error: (400) Bad Request.
     at System.Net.WebClient.DownloadDataInternal(Uri address, WebRequest&amp; request)
     at System.Net.WebClient.DownloadString(Uri address)
     at Microsoft.WindowsAzure.GuestAgent.Plugins.MsiUtils.WebClient.&lt;&gt;c__DisplayClass3_0.&lt;DownloadStringWithRetries&gt;b__0()
     at Microsoft.WindowsAzure.GuestAgent.Plugins.MsiUtils.WebClientWithRetryAbstract.ActionWithRetries(Action action)
     at Microsoft.WindowsAzure.GuestAgent.Plugins.MsiUtils.WebClient.DownloadStringWithRetries(Uri address)
     at Microsoft.WindowsAzure.GuestAgent.Plugins.MsiUtils.MsiProvider.GetMsiHelper(NameValueCollection queries)
  [7108+00000001] [11/20/2020 09:12:31.14] [INFO] Msi was not obtained
  </code></pre>
  <p>I can retrieve the identity token from the metadata endpoint via <code>Invoke-WebRequest -Method Get -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&amp;resource=https://management.azure.com/'</code> so that appears to be set up correctly.</p>
  <p>Any advice on what the problem could be or how to further diagnose this issue would be greatly appreciated.</p>