com.azure.storage.blob.models.BlobStorageException when trying to deploy a windows-based VM

[quimicefa]

Jenkins and plugins versions report

Environment

Jenkins: 2.516.3
OS: Linux - 3.10.0-1160.141.1.el7.x86_64
Java: 21 - Eclipse Adoptium (OpenJDK 64-Bit Server VM)

PrioritySorter:863.v4a_b_974a_5d042
TestComplete:2.10
ace-editor:1.1
analysis-model-api:13.8.0-902.v26f80296f743
ant:518.v8d8dc7945eca_
antisamy-markup-formatter:173.v680e3a_b_69ff3
apache-httpcomponents-client-4-api:4.5.14-269.vfa_2321039a_83
apache-httpcomponents-client-5-api:5.5-166.v870a_96374f91
artifactory:4.0.8
asm-api:9.8-163.vb_2a_96d3f9c3c
atlassian-jira-software-cloud:2.0.15
authentication-tokens:1.144.v5ff4a_5ec5c33
azure-credentials:395.vb_a_9203343ef5
azure-keyvault:282.v43b_691a_13d19
azure-sdk:243.v4a_0d23a_c71a_7
azure-vm-agents:1050.v45467b_03322a_
bitbucket:282.1.0
bitbucket-scm-filter-aged-refs:59.0.0-M.3
blueocean:1.27.21
blueocean-autofavorite:1.2.5
blueocean-bitbucket-pipeline:1.27.21
blueocean-commons:1.27.21
blueocean-config:1.27.21
blueocean-core-js:1.27.21
blueocean-dashboard:1.27.21
blueocean-display-url:2.4.4
blueocean-events:1.27.21
blueocean-git-pipeline:1.27.21
blueocean-github-pipeline:1.27.21
blueocean-i18n:1.27.21
blueocean-jira:1.27.21
blueocean-jwt:1.27.21
blueocean-personalization:1.27.21
blueocean-pipeline-api-impl:1.27.21
blueocean-pipeline-editor:1.27.21
blueocean-pipeline-scm-api:1.27.21
blueocean-rest:1.27.21
blueocean-rest-impl:1.27.21
blueocean-web:1.27.21
bootstrap4-api:4.6.0-6
bootstrap5-api:5.3.7-860.v1251c115c90c
bouncycastle-api:2.30.1.81-264.v95c79c0e772c
branch-api:2.1244.vf95c81f1641c
build-timeout:1.38
caffeine-api:3.2.2-178.v353b_8428ed56
checks-api:373.vfe7645102093
cloud-stats:377.vd8a_6c953e98e
cloudbees-bitbucket-branch-source:937.0.1
cloudbees-folder:6.1040.v8a_e6330a_54e3
cobertura:1.17
code-coverage-api:4.99.0
command-launcher:123.v37cfdc92ef67
commons-collections4-api:4.5.0-8.va_d5448ef9011
commons-compress-api:1.28.0-1
commons-lang3-api:3.18.0-98.v3a_674c06072d
commons-text-api:1.14.0-194.v804a_dc3a_1b_d8
conditional-buildstep:1.5.0
config-file-provider:994.v3d4a_5fa_f353a_
configuration-as-code:1985.vdda_32d0c4ea_b_
coverage:2.2912.v3dea_6a_4a_73f7
credentials:1447.v4cb_b_539b_5321
credentials-binding:702.vfe613e537e88
cucumber-reports:5.10.0
custom-tools-plugin:0.8
data-tables-api:2.3.3-1383.va_5607a_a_3f3c2
delivery-pipeline-plugin:1.4.2
dependency-check-jenkins-plugin:5.6.1
dependency-track:6.0.2
discard-old-build:1.08
display-url-api:2.217.va_6b_de84cc74b_
docker-commons:457.v0f62a_94f11a_3
docker-workflow:621.va_73f881d9232
durable-task:595.ve87b_f1318d67
echarts-api:6.0.0-1146.v5c8f3b_8f0573
eddsa-api:0.3.0.1-19.vc432d923e5ee
email-ext:1925.v1598902b_58dd
emailext-template:233.v1eb_88fc160b_5
extended-choice-parameter:388.ve7b_d0b_920e10
external-monitor-job:223.vb_fddcf42c9b_3
extra-tool-installers:202.v32436898800a_
favorite:2.253.v9b_413168133b_
file-parameters:385.v1cf03fdff8ce
flatpickr-api:4.6.13-18.vcf5f6a_5b_8468
font-awesome-api:7.0.0-851.vd1feb_218a_a_63
forensics-api:3.1754.v2a_6613b_77002
gatling:1.3.0
git:5.7.0
git-client:6.3.3
git-parameter:444.vca_b_84d3703c2
git-server:137.ve0060b_432302
github:1.45.0
github-api:1.330-492.v3941a_032db_2a_
github-branch-source:1862.v1a_fc22a_d3788
global-build-stats:347.v32a_eb_0493c4f
gradle:2.16.1149.v711b_998b_0532
gson-api:2.13.2-173.va_a_092315913c
h2-api:11.1.4.199-36.vb_ee07e965744
handlebars:3.0.8
handy-uri-templates-2-api:2.1.8-36.v85e4cb_234a_13
htmlpublisher:427
instance-identity:203.v15e81a_1b_7a_38
ionicons-api:94.vcc3065403257
ivy:582.v35fb_da_0312f7
jackson2-api:2.20.0-411.v6ef8fdee4fe9
jakarta-activation-api:2.1.3-2
jakarta-mail-api:2.1.3-3
javadoc:354.vee1a_660b_4990
javax-activation-api:1.2.0-8
javax-mail-api:1.6.2-11
jaxb:2.3.9-133.vb_ec76a_73f706
jdk-tool:83.v417146707a_3d
jenkins-design-language:1.27.21
jersey2-api:2.47-165.ve7809a_3e87e0
jira:3.19
jira-steps:2.0.180.vccfe35b_5910d
jjwt-api:0.11.5-120.v0268cf544b_89
job-dsl:1.93
jobConfigHistory:1356.ve360da_6c523a_
joda-time-api:2.14.0-149.v1c3ce991d1b_9
jquery:1.12.4-3
jquery-detached:1.2.1
jquery3-api:3.7.1-594.vb_3864f326cf0
jsch:0.2.16-95.v3eecb_55fa_b_78
json-api:20250517-173.v596efb_962a_31
json-path-api:2.9.0-190.veefca_05d5477
jsoup:1.21.2-66.v6ea_38164b_8a_2
junit:1355.v45e2ea_65863c
junit-attachments:330.v25180b_263160
ldap:780.vcb_33c9a_e4332
lockable-resources:1412.v3f305a_fb_a_117
mailer:522.va_995fa_cfb_8b_d
mapdb-api:1.0.9-44.va_1e1310c9118
mask-passwords:204.v24d863065180
matrix-auth:3.2.8
matrix-project:858.vb_b_eb_9a_7ea_99e
maven-plugin:3.27
mercurial:1323.ve69d2a_db_8a_b_d
metrics:4.2.33-484.v2fcd689980d1
mina-sshd-api-common:2.16.0-167.va_269f38cc024
mina-sshd-api-core:2.16.0-167.va_269f38cc024
momentjs:1.1.1
monitoring:2.5.0
netty-api:4.1.118.Final-9.v776038d601a_7
next-build-number:66.v4b_4762172d53
nodejs:1.6.5
nunit:593.v76f7a_5f959c1
okhttp-api:4.11.0-189.v976fa_d3379d6
oss-symbols-api:392.v27a_482d90083
pam-auth:1.12
parameterized-trigger:873.v8b_e37dd8418f
pipeline-build-step:571.v08a_fffd4b_0ce
pipeline-github-lib:65.v203688e7727e
pipeline-graph-analysis:245.v88f03631a_b_21
pipeline-groovy-lib:752.vdddedf804e72
pipeline-input-step:534.v352f0a_e98918
pipeline-maven:1563.v2e75645a_7d43
pipeline-maven-api:1567.vb_2c3a_2116860
pipeline-milestone-step:138.v78ca_76831a_43
pipeline-model-api:2.2265.v140e610fe9d5
pipeline-model-definition:2.2265.v140e610fe9d5
pipeline-model-extensions:2.2265.v140e610fe9d5
pipeline-rest-api:2.38
pipeline-stage-step:322.vecffa_99f371c
pipeline-stage-tags-metadata:2.2265.v140e610fe9d5
pipeline-stage-view:2.38
pipeline-utility-steps:2.19.0
plain-credentials:199.v9f8e1f741799
plugin-util-api:6.1167.v022176c7e0ca_
popper-api:1.16.1-3
popper2-api:2.11.6-5
prism-api:1.30.0-609.vf0a_df102d9a_f
pubsub-light:1.19
resource-disposer:0.25
role-strategy:799.v5b_e7b_ecc231e
run-condition:243.v3c3f94e46a_8b_
scm-api:707.v749f968369d4
scoring-load-balancer:202.ve8d1e11694e2
script-security:1378.vf25626395f49
snakeyaml-api:2.3-125.v4d77857a_b_402
sonar:2.18
sse-gateway:1.28
ssh-agent:386.v36cc0c7582f0
ssh-credentials:361.vb_f6760818e8c
ssh-slaves:3.1071.v0d059c7b_c555
sshd:3.374.v19b_d59ce6610
stashNotifier:1.528.v9637674a_673f
structs:353.v261ea_40a_80fb_
subversion:1292.ve8cf25770ee3
throttle-concurrents:2.18
timestamper:1.30
token-macro:477.vd4f0dc3cb_cf1
trilead-api:2.209.v0e69b_c43c245
uno-choice:2.8.8
variant:70.va_d9f17f859e0
warnings-ng:12.9783.ve1cb_9f060738
windows-slaves:1.8.1
workflow-aggregator:608.v67378e9d3db_1
workflow-api:1384.vdc05a_48f535f
workflow-basic-steps:1079.vce64b_a_929c5a_
workflow-cps:4183.v94b_6fd39da_c1
workflow-cps-global-lib:615.vb_b_0664a_b_19f3
workflow-durable-task-step:1458.va_2e10a_a_b_7c4d
workflow-job:1546.v62a_c59c112dd
workflow-multibranch:811.vcd33d074c2a_0
workflow-scm-step:437.v05a_f66b_e5ef8
workflow-step-api:706.v518c5dcb_24c0
workflow-support:976.vb_d9493c2eb_09
ws-cleanup:0.49
xml-job-to-job-dsl:0.1.13

What Operating System are you using (both controller, and any agents involved in the problem)?

RHEL Linux in controller.
Ubuntu 24 in workers (OK)
W10 / W11 / Windows server 20XX in workers (KO)

Reproduction steps

1. define a template in a jenkins cloud connection, using a built-in image, assign a label to the template.
2. using a ubuntu template works fine: the agent is deployed and registered as worker in jenkins.
3. change the template to another basic based on windows (w server 2016, 2019, 2022, 2025).
4. the error is shown in less than 10s:

Expected Results

the VM is deployed in azure and registered as jenkins worker.

Actual Results

com.azure.storage.blob.models.BlobStorageException: If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call.
If you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call.
Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII.
If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call.
If you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call.
Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII.
Status code 403, "<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationFailure</Code><Message>This request is not authorized to perform this operation.
RequestId:asdfasdfasdf
Time:2025-11-27T10:40:34.6238110Z</Message></Error>"
	at PluginClassLoader for azure-sdk//com.azure.storage.blob.implementation.util.ModelHelper.mapToBlobStorageException(ModelHelper.java:660)
	at PluginClassLoader for azure-sdk//com.azure.storage.blob.implementation.ContainersImpl.getPropertiesWithResponse(ContainersImpl.java:1474)
	at PluginClassLoader for azure-sdk//com.azure.storage.blob.BlobContainerClient.lambda$getPropertiesWithResponse$2(BlobContainerClient.java:672)
	at PluginClassLoader for azure-sdk//com.azure.storage.common.implementation.StorageImplUtils.sendRequest(StorageImplUtils.java:494)
	at PluginClassLoader for azure-sdk//com.azure.storage.blob.BlobContainerClient.getPropertiesWithResponse(BlobContainerClient.java:674)
	at PluginClassLoader for azure-sdk//com.azure.storage.blob.BlobContainerClient.existsWithResponse(BlobContainerClient.java:345)
	at PluginClassLoader for azure-sdk//com.azure.storage.blob.BlobContainerClient.exists(BlobContainerClient.java:324)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMManagementServiceDelegate.getCloudBlobContainer(AzureVMManagementServiceDelegate.java:2919)
Caused: com.microsoft.azure.vmagent.exceptions.AzureCloudException
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.exceptions.AzureCloudException.create(AzureCloudException.java:54)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.exceptions.AzureCloudException.create(AzureCloudException.java:33)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMManagementServiceDelegate.getCloudBlobContainer(AzureVMManagementServiceDelegate.java:2925)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMManagementServiceDelegate.getCloudBlobContainer(AzureVMManagementServiceDelegate.java:2948)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMManagementServiceDelegate.uploadCustomScript(AzureVMManagementServiceDelegate.java:1140)
Caused: com.microsoft.azure.vmagent.exceptions.AzureCloudException: Failed to create Page Blob with script's length: 0
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.exceptions.AzureCloudException.create(AzureCloudException.java:54)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMManagementServiceDelegate.uploadCustomScript(AzureVMManagementServiceDelegate.java:1149)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMManagementServiceDelegate.createDeployment(AzureVMManagementServiceDelegate.java:623)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMManagementServiceDelegate.createDeployment(AzureVMManagementServiceDelegate.java:221)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMAgentTemplate.provisionAgents(AzureVMAgentTemplate.java:1359)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMCloud$1.call(AzureVMCloud.java:823)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMCloud$1.call(AzureVMCloud.java:819)
Caused: java.util.concurrent.ExecutionException
	at java.base/java.util.concurrent.FutureTask.report(FutureTask.java:122)
	at java.base/java.util.concurrent.FutureTask.get(FutureTask.java:191)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMCloud$2.call(AzureVMCloud.java:854)
Caused: com.microsoft.azure.vmagent.exceptions.AzureCloudException
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.exceptions.AzureCloudException.create(AzureCloudException.java:54)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.exceptions.AzureCloudException.create(AzureCloudException.java:33)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMCloud$2.call(AzureVMCloud.java:857)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMCloud$2.call(AzureVMCloud.java:843)
	at jenkins.util.ContextResettingExecutorService$2.call(ContextResettingExecutorService.java:46)
	at jenkins.security.ImpersonatingExecutorService$2.call(ImpersonatingExecutorService.java:80)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
	at java.base/java.lang.Thread.run(Thread.java:1583)

Anything else?

It could be related to some permission assigned to the service principal that is not needed in Linux VMs but is somehow required for windows VMs?

Are you interested in contributing a fix?

No response

[quimicefa]

Activating jenkins logs to FINE in both com.azure.* and com.microsoft.azure.* I can spot these lines when trying to create a windows-based VM, just before the SAS token error:

se embedded deployment template (with script and managed) /referenceImageTemplateWithScriptAndManagedDisk.json
Nov 28, 2025 12:25:28 PM FINE com.microsoft.azure.vmagent.AzureVMNoDelayProvisionerStrategy
Available capacity=1, currentDemand=1
Nov 28, 2025 12:25:28 PM FINE com.microsoft.azure.vmagent.AzureVMNoDelayProvisionerStrategy
Provisioning completed
Nov 28, 2025 12:25:28 PM FINE com.microsoft.azure.vmagent.AzureVMManagementServiceDelegate
The suffix for construct CloudStorageCloud is https://a1.blob.core.windows.net/
Nov 28, 2025 12:25:29 PM SEVERE com.microsoft.azure.vmagent.AzureVMManagementServiceDelegate getCloudBlobContainer
Unable to get container jenkinsconfig
com.azure.storage.blob.models.BlobStorageException: If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call.
If you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call.
Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII.
If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call.
If you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call.
Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII.
Status code 403, "AuthorizationFailureThis request is not authorized to perform this operation.
RequestId:7ece1b5f-001e-0076-2059-600260000000
Time:2025-11-28T11:25:28.9956087Z"

Deploying a linux-based VM soes not get the "Unable to get container jenkinsconfig " message.

[quimicefa]

Happy new year!
I just tried the same but using an azure gallery image (based on W11, plus java. generalized) instead of the basic image. The error stays the same. I'm pretty sure it's some missing permission that makes sense only in windows-based VMs

Create VM with gallery image id /subscriptions/251<REDACTED>524d993c/resourceGroups/gf<REDACTED>tools/providers/Microsoft.Compute/galleries/azeg<REDACTED>ools01/images/W11<REDACTED>ate2/versions/0.0.1
Jan 08, 2026 9:51:52 AM FINE com.microsoft.azure.vmagent.AzureVMNoDelayProvisionerStrategy
Available capacity=1, currentDemand=1
Jan 08, 2026 9:51:52 AM FINE com.microsoft.azure.vmagent.AzureVMNoDelayProvisionerStrategy
Provisioning completed
Jan 08, 2026 9:51:52 AM FINE com.microsoft.azure.vmagent.AzureVMManagementServiceDelegate
The suffix for construct CloudStorageCloud is https://aze<REDACTED>op01.blob.core.windows.net/
Jan 08, 2026 9:51:52 AM SEVERE com.microsoft.azure.vmagent.AzureVMManagementServiceDelegate getCloudBlobContainer
Unable to get container jenkinsconfig
com.azure.storage.blob.models.BlobStorageException: If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call.
If you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call.
Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII.
If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call.
If you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call.
Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII.
Status code 403, "<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationFailure</Code><Message>This request is not authorized to perform this operation.
RequestId:5e410e0b-701e-0043-387c-806e74000000
Time:2026-01-08T08:51:52.8949169Z</Message></Error>"
	at PluginClassLoader for azure-sdk//com.azure.storage.blob.implementation.util.ModelHelper.mapToBlobStorageException(ModelHelper.java:660)
	at PluginClassLoader for azure-sdk//com.azure.storage.blob.implementation.ContainersImpl.getPropertiesWithResponse(ContainersImpl.java:1474)
	at PluginClassLoader for azure-sdk//com.azure.storage.blob.BlobContainerClient.lambda$getPropertiesWithResponse$2(BlobContainerClient.java:672)
	at PluginClassLoader for azure-sdk//com.azure.storage.common.implementation.StorageImplUtils.sendRequest(StorageImplUtils.java:494)
	at PluginClassLoader for azure-sdk//com.azure.storage.blob.BlobContainerClient.getPropertiesWithResponse(BlobContainerClient.java:674)
	at PluginClassLoader for azure-sdk//com.azure.storage.blob.BlobContainerClient.existsWithResponse(BlobContainerClient.java:345)
	at PluginClassLoader for azure-sdk//com.azure.storage.blob.BlobContainerClient.exists(BlobContainerClient.java:324)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMManagementServiceDelegate.getCloudBlobContainer(AzureVMManagementServiceDelegate.java:2919)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMManagementServiceDelegate.getCloudBlobContainer(AzureVMManagementServiceDelegate.java:2948)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMManagementServiceDelegate.uploadCustomScript(AzureVMManagementServiceDelegate.java:1140)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMManagementServiceDelegate.createDeployment(AzureVMManagementServiceDelegate.java:623)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMManagementServiceDelegate.createDeployment(AzureVMManagementServiceDelegate.java:221)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMAgentTemplate.provisionAgents(AzureVMAgentTemplate.java:1359)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMCloud$1.call(AzureVMCloud.java:823)
	at PluginClassLoader for azure-vm-agents//com.microsoft.azure.vmagent.AzureVMCloud$1.call(AzureVMCloud.java:819)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
	at java.base/java.lang.Thread.run(Thread.java:1583)

Jan 08, 2026 9:52:01 AM FINE com.microsoft.azure.vmagent.AzureVMNoDelayProvisionerStrategy
Available capacity=0, currentDemand=1

Can you guys provide some help to detect what's the missing permission? Maybe there is a conflicting azure policy , or the service principal has been created with some wrong options (?).

[timja]

Can you provide the XML file for the template?

[quimicefa]

@timja I don't know what XML your are asking for? is this some template format from jenkins?

[timja]

in your JENKINS_HOME on the filesystem there's a file called config.xml. The contents of the clouds section, (replacing anything you don't want to share with stars ***)

[quimicefa]

<?xml version='1.1' encoding='UTF-8'?>
<hudson>
  <clouds>
    <com.microsoft.azure.vmagent.AzureVMCloud plugin="azure-vm-agents@1050.v45467b_03322a_">
      <actions/>
      <name>Azure Cloud - PROD RG</name>
      <credentialsId>azure-service-principal</credentialsId>
      <maxVirtualMachinesLimit>25</maxVirtualMachinesLimit>
      <resourceGroupReferenceType>existing</resourceGroupReferenceType>
      <newResourceGroupName></newResourceGroupName>
      <existingResourceGroupName>GF-*****-DE*****TTOOLS</existingResourceGroupName>
      <vmTemplates class="java.util.concurrent.CopyOnWriteArrayList">
        <com.microsoft.azure.vmagent.AzureVMAgentTemplate>
          <templateName>dockerhostwin-v1-2</templateName>
          <templateDesc>dockerhostwindows docker(+compose) instead of podman</templateDesc>
          <labels>DockerHostWindows-new</labels>
          <location>Germany West Central</location>
          <availabilityType class="com.microsoft.azure.vmagent.availability.NoAvailabilityRequired"/>
          <virtualMachineSize>Standard_D4a_v4</virtualMachineSize>
          <storageAccountNameReferenceType>existing</storageAccountNameReferenceType>
          <diskType>managed</diskType>
          <ephemeralOSDisk>false</ephemeralOSDisk>
          <encryptionAtHost>false</encryptionAtHost>
          <osDiskSize>0</osDiskSize>
          <newStorageAccountName></newStorageAccountName>
          <existingStorageAccountName>azes******p01</existingStorageAccountName>
          <storageAccountType>Standard_LRS</storageAccountType>
          <osDiskStorageAccountType>Standard_LRS</osDiskStorageAccountType>
          <noOfParallelJobs>1</noOfParallelJobs>
          <usageMode>EXCLUSIVE</usageMode>
          <shutdownOnIdle>false</shutdownOnIdle>
          <imageTopLevelType>basic</imageTopLevelType>
          <imageReference>
            <publisher></publisher>
            <offer></offer>
            <sku></sku>
            <version>latest</version>
            <galleryImageSpecialized>false</galleryImageSpecialized>
            <type>REFERENCE</type>
          </imageReference>
          <builtInImage>Windows Server 2019</builtInImage>
          <installGit>true</installGit>
          <installMaven>false</installMaven>
          <installDocker>true</installDocker>
          <installQemu>false</installQemu>
          <trustedLaunch>false</trustedLaunch>
          <osType>Linux</osType>
          <launcher class="com.microsoft.azure.vmagent.launcher.AzureSSHLauncher">
            <sshConfig></sshConfig>
            <preInstallSsh>false</preInstallSsh>
          </launcher>
          <initScript></initScript>
          <terminateScript></terminateScript>
          <credentialsId>jenkins-linux</credentialsId>
          <agentWorkspace>c:\jenkins</agentWorkspace>
          <retentionTimeInMin>0</retentionTimeInMin>
          <virtualNetworkName>azevn*****enttools01</virtualNetworkName>
          <virtualNetworkResourceGroupName>GF-*******NTTOOLS-VNET</virtualNetworkResourceGroupName>
          <subnetName>Spot</subnetName>
          <usePrivateIP>true</usePrivateIP>
          <spotInstance>true</spotInstance>
          <acceleratedNetworking>false</acceleratedNetworking>
          <nsgName></nsgName>
          <jvmOptions></jvmOptions>
          <remotingOptions></remotingOptions>
          <templateDisabled>false</templateDisabled>
          <templateVerified>false</templateVerified>
          <executeInitScriptAsRoot>false</executeInitScriptAsRoot>
          <doNotUseMachineIfInitFails>true</doNotUseMachineIfInitFails>
          <enableMSI>false</enableMSI>
          <enableUAMI>false</enableUAMI>
          <useEntraIdForStorageAccount>false</useEntraIdForStorageAccount>
          <uamiID></uamiID>
          <javaPath>java</javaPath>
          <retentionStrategy class="com.microsoft.azure.vmagent.AzureVMCloudRetensionStrategy">
            <idleTerminationMillis>300000</idleTerminationMillis>
            <idleTerminationMinutes>5</idleTerminationMinutes>
          </retentionStrategy>
          <maximumDeploymentSize>10</maximumDeploymentSize>
          <tags>
            <com.microsoft.azure.vmagent.AzureTagPair>
              <name>JenkinsLabel</name>
              <value>DockerHostWindows</value>
            </com.microsoft.azure.vmagent.AzureTagPair>
          </tags>
          <maxVirtualMachinesLimit>15</maxVirtualMachinesLimit>
          <licenseType>None</licenseType>
          <nodeProperties>
            <hudson.slaves.EnvironmentVariablesNodeProperty>
              <envVars serialization="custom">
                <unserializable-parents/>
                <tree-map>
                  <default>
                    <comparator class="java.lang.String$CaseInsensitiveComparator" reference="../../../../../../../com.microsoft.azure.vmagent.AzureVMAgentTemplate/nodeProperties/hudson.slaves.EnvironmentVariablesNodeProperty/envVars/tree-map/default/comparator"/>
                  </default>
                  <int>1</int>
                  <string>DG_CLOUD_BUILDER</string>
                  <string>Azure</string>
                </tree-map>
              </envVars>
            </hudson.slaves.EnvironmentVariablesNodeProperty>
            <hudson.plugins.jobConfigHistory.NodeLocalConfiguration plugin="jobConfigHistory@1356.ve360da_6c523a_">
              <changeReasonComment></changeReasonComment>
            </hudson.plugins.jobConfigHistory.NodeLocalConfiguration>
          </nodeProperties>
        </com.microsoft.azure.vmagent.AzureVMAgentTemplate>
      </vmTemplates>
      <deploymentTimeout>1200</deploymentTimeout>
      <cloudTags>
        <com.microsoft.azure.vmagent.AzureTagPair>
          <name>JenkinsEnvironment</name>
          <value>prod</value>
        </com.microsoft.azure.vmagent.AzureTagPair>
      </cloudTags>
    </com.microsoft.azure.vmagent.AzureVMCloud>
  </clouds>
</hudson>

This is the relevant cloud section for the windows template. I've realized the existince of the atribute Linux tha makes no sense?

The log message I'm getting is the same as I posted in the initial description.

[timja]

The codes not very optimised to ensure the cleanest configuration saving. That it says linux could be ok.
I'll need to load the config and debug the code when I get time.

[timja]

I was able to start one fine with that template - although kept getting SKU errors, turns out there was no spot capacity and I had to disable that -.-, error message just talked about capacity restrictions...

Had to remove the Install docker checkbox that doesn't work for Windows 2019.

Have you got Contributor for your service principal over either:

1. The subscription
2. The Cloud resource group, the storage account and the Virtual network

[quimicefa]

I was able to start one fine with that template - although kept getting SKU errors, turns out there was no spot capacity and I had to disable that -.-, error message just talked about capacity restrictions...

Had to remove the Install docker checkbox that doesn't work for Windows 2019.

Have you got Contributor for your service principal over either:

1. The subscription
2. The Cloud resource group, the storage account and the Virtual network

I double checked this with the cloud operations team ... so far, the user principal we're using here has contributor on the RG and networks (otherwise the setup would fail for Linux VMs also).

I created a Agent template from scratch, instead of using one of the (Linux) working ones.

[timja]

What about the storage account permissions?

Windows uses the storage account, linux doesn't necessarily use it in all cases.

[BenPortner]

I'm experiencing the same error. The Jenkins controller has:

• Virtual Machine Contributor on the resource group
• Network Contributor on the virtual network
• Storage Account reader and data access on the storage account
• Azure Compute Gallery reader on the VM image definition

My config:

    <com.microsoft.azure.vmagent.AzureVMCloud plugin="azure-vm-agents@1093.va_9cd2dd11158">
      <actions/>
      <name>Azure</name>
      <credentialsId>***</credentialsId>
      <maxVirtualMachinesLimit>2</maxVirtualMachinesLimit>
      <resourceGroupReferenceType>existing</resourceGroupReferenceType>
      <newResourceGroupName>my_resource_group</newResourceGroupName>
      <existingResourceGroupName>my_resource_group</existingResourceGroupName>
      <vmTemplates class="java.util.concurrent.CopyOnWriteArrayList">
        <com.microsoft.azure.vmagent.AzureVMAgentTemplate>
          <templateName>my-agent</templateName>
          <templateDesc></templateDesc>
          <labels>agent</labels>
          <location>West Europe</location>
          <availabilityType class="com.microsoft.azure.vmagent.availability.NoAvailabilityRequired"/>
          <virtualMachineSize>Standard_B4ms</virtualMachineSize>
          <storageAccountNameReferenceType>existing</storageAccountNameReferenceType>
          <diskType>managed</diskType>
          <ephemeralOSDisk>false</ephemeralOSDisk>
          <encryptionAtHost>false</encryptionAtHost>
          <disableWindowsUpdates>false</disableWindowsUpdates>
          <osDiskSize>0</osDiskSize>
          <newStorageAccountName></newStorageAccountName>
          <existingStorageAccountName>my_storage_account</existingStorageAccountName>
          <storageAccountType>Standard_LRS</storageAccountType>
          <osDiskStorageAccountType>StandardSSD_LRS</osDiskStorageAccountType>
          <dataDisks/>
          <noOfParallelJobs>1</noOfParallelJobs>
          <usageMode>EXCLUSIVE</usageMode>
          <shutdownOnIdle>true</shutdownOnIdle>
          <imageTopLevelType>advanced</imageTopLevelType>
          <imageReference>
            <galleryName>my_gallery</galleryName>
            <galleryImageDefinition>my_image_def</galleryImageDefinition>
            <galleryImageVersion>0.1.0</galleryImageVersion>
            <galleryImageSpecialized>true</galleryImageSpecialized>
            <gallerySubscriptionId>***</gallerySubscriptionId>
            <galleryResourceGroup>my_resource_group</galleryResourceGroup>
            <type>GALLERY</type>
          </imageReference>
          <builtInImage>Ubuntu 24.04 LTS</builtInImage>
          <installGit>false</installGit>
          <installMaven>false</installMaven>
          <installDocker>false</installDocker>
          <installQemu>false</installQemu>
          <trustedLaunch>true</trustedLaunch>
          <osType>Windows</osType>
          <launcher class="com.microsoft.azure.vmagent.launcher.AzureSSHLauncher">
            <sshConfig></sshConfig>
            <preInstallSsh>true</preInstallSsh>
          </launcher>
          <initScript></initScript>
          <terminateScript></terminateScript>
          <credentialsId>***</credentialsId>
          <agentWorkspace></agentWorkspace>
          <retentionTimeInMin>0</retentionTimeInMin>
          <virtualNetworkName>my_network</virtualNetworkName>
          <virtualNetworkResourceGroupName>my_network_resource_group</virtualNetworkResourceGroupName>
          <subnetName>my_subnet</subnetName>
          <usePrivateIP>true</usePrivateIP>
          <spotInstance>false</spotInstance>
          <acceleratedNetworking>false</acceleratedNetworking>
          <nsgName></nsgName>
          <jvmOptions></jvmOptions>
          <remotingOptions></remotingOptions>
          <templateDisabled>false</templateDisabled>
          <templateVerified>false</templateVerified>
          <executeInitScriptAsRoot>false</executeInitScriptAsRoot>
          <doNotUseMachineIfInitFails>false</doNotUseMachineIfInitFails>
          <enableMSI>false</enableMSI>
          <enableUAMI>false</enableUAMI>
          <useEntraIdForStorageAccount>false</useEntraIdForStorageAccount>
          <uamiID></uamiID>
          <javaPath>java</javaPath>
          <retentionStrategy class="com.microsoft.azure.vmagent.AzureVMCloudRetensionStrategy">
            <idleTerminationMillis>3600000</idleTerminationMillis>
            <idleTerminationMinutes>60</idleTerminationMinutes>
          </retentionStrategy>
          <maximumDeploymentSize>1</maximumDeploymentSize>
          <tags/>
          <maxVirtualMachinesLimit>2</maxVirtualMachinesLimit>
          <licenseType>Windows_Client</licenseType>
          <nodeProperties/>
        </com.microsoft.azure.vmagent.AzureVMAgentTemplate>
      </vmTemplates>
      <deploymentTimeout>1200</deploymentTimeout>
      <cloudTags/>
    </com.microsoft.azure.vmagent.AzureVMCloud>

[timja]

By default you'll need Storage Account Contributor or Contributor on the storage account too.

There is a checkbox to use the RBAC access (data roles) but it won't use them by default.

Can you try that?

[BenPortner]

Hi @timja, my cloud operations team informed me that there is no such role. Contributor access has to be set per data type (Blob, Table, Queues, Files). Is this the one you mean? I also couldn't find any checkbox that had RBAC in its label. Could you clarify?

[timja]

my cloud operations team informed me that there is no such role

really... https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage#storage-account-contributor