How to Run a PowerShell Script on a Windows Azure VM After Provisioning Without Interactive Logon
You have already deployed a Windows Server VM. After provisioning, you need to run a PowerShell script once to configure an application and create a registry setting without logging in interactively. Which Azure feature should you use?
Quick Answer
The answer is the Custom Script Extension, which is the correct Azure feature to run a PowerShell script on a Windows Azure VM after provisioning without interactive logon. This extension executes the script as the local system account, meaning no user login or RDP session is required, making it perfect for one-time configuration tasks such as creating registry settings or installing applications. On the AZ-104 exam, this question tests your understanding of VM extensions and their use cases, often appearing in scenarios where you need post-deployment automation without manual intervention. A common trap is confusing the Custom Script Extension with Desired State Configuration (DSC); remember that CSE is for one-time execution, while DSC is for ongoing state management. Memory tip: think “CSE for one-time setup, DSC for continuous compliance.”
⚠ Common exam trap
Many candidates confuse cloud-init (a Linux-only tool) with the Custom Script Extension, mistakenly assuming cloud-init works on Windows VMs, or they think Azure Policy can execute scripts when it only evaluates and enforces policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Custom Script Extension
The Custom Script Extension (CSE) is the correct choice because it allows you to run a PowerShell script on a Windows VM after provisioning, without requiring interactive logon. It executes the script as the local system account, making it ideal for one-time configuration tasks like setting registry keys or installing applications. This aligns with the requirement to run a script once non-interactively.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Custom Script Extension
Why this is correct
This extension can download and run a script on a VM after deployment without requiring interactive logon.
- ✗
cloud-init
Why it's wrong here
cloud-init is used for Linux first-boot configuration and is not the normal Windows post-deployment script option.
When this WOULD be correct
When deploying a Linux VM that needs to run a script or configuration during initial provisioning (e.g., installing packages, setting hostname) without interactive login, cloud-init is the correct choice.
- ✗
Azure Policy
Why it's wrong here
Azure Policy can enforce configuration rules, but it does not execute a one-time application setup script on a VM.
When this WOULD be correct
An exam question asking how to enforce that all VMs in a subscription must have a specific registry key or application installed, using a policy definition with a DeployIfNotExists effect that triggers a custom script extension.
- ✗
Recovery Services vault
Why it's wrong here
A Recovery Services vault is used for backup operations, not for running VM configuration scripts.
When this WOULD be correct
You need to protect your Azure VMs by enabling backup and configuring retention policies for disaster recovery scenarios.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Custom Script ExtensionCorrect answer▾
Why this is correct
This extension can download and run a script on a VM after deployment without requiring interactive logon.
✗cloud-initWrong answer — click to see why▾
Why this is wrong here
cloud-init is designed for Linux VM initialization during first boot, not for Windows Server VMs, and it cannot run PowerShell scripts on Windows.
★ When this WOULD be the correct answer
When deploying a Linux VM that needs to run a script or configuration during initial provisioning (e.g., installing packages, setting hostname) without interactive login, cloud-init is the correct choice.
Why candidates choose this
Candidates may confuse cloud-init as a generic VM extension similar to Custom Script Extension, not realizing it is Linux-specific and not supported on Windows.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy is used to enforce compliance rules and audit configurations across resources, not to execute scripts on a single VM after deployment.
★ When this WOULD be the correct answer
An exam question asking how to enforce that all VMs in a subscription must have a specific registry key or application installed, using a policy definition with a DeployIfNotExists effect that triggers a custom script extension.
Why candidates choose this
Candidates may confuse Azure Policy's ability to enforce configurations with the ability to run scripts, not realizing that Policy itself does not execute code but can trigger remediation tasks.
✗Recovery Services vaultWrong answer — click to see why▾
Why this is wrong here
Recovery Services vault is used for backup and disaster recovery (Azure Backup, Site Recovery), not for executing scripts on a VM after provisioning.
★ When this WOULD be the correct answer
You need to protect your Azure VMs by enabling backup and configuring retention policies for disaster recovery scenarios.
Why candidates choose this
Candidates may confuse Recovery Services vault with Azure Automation or Runbooks, thinking it can run scripts, but its primary purpose is backup/recovery.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to run a script on VM-App02 immediately after deployment to install a custom monitoring agent. The solution should not require opening additional inbound management ports. What should you use?
medium- A.Boot diagnostics
- ✓ B.Custom Script Extension
- C.An inbound NSG rule for WinRM
- D.A proximity placement group
Why B: The Custom Script Extension (CSE) is the correct choice because it allows you to run a script on a VM immediately after deployment without opening any inbound management ports. CSE downloads and executes scripts on the VM via the Azure fabric, using the VM's outbound connectivity to Azure storage or GitHub, and does not require any inbound port (like RDP or WinRM) to be open. This meets the requirement of not opening additional inbound management ports while enabling post-deployment configuration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.