when WAD installing the command succeed even though storageAccountSasToken is empty (in LAD, installation fail when storageAccountSasToken is empty)

[dainomat]

Hi experts,

When az vm diagnostics set running, WAD installation will succeed even though storageAccountSasToken is empty. However, in LAD installation, it will fail.

"storageAccountSasToken is empty" mean like this:
set="{'storageAccountName':'$sa', 'storageAccountSasToken':''}"
extension=$(az vm diagnostics set --settings "$defcon" --protected-settings "$set" --subscription $subscription --resource-group $rg --vm-name $vm -o tsv --query name)

I think it should fail when storageAccountSasToken is empty because this value is essential. Please revise code not to install.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 7a9ab822-6524-9dd7-3bf4-1889e10d1266
• Version Independent ID: ec780873-d291-dda8-6b1d-c410e2d87b98
• Content: az vm diagnostics
• Content Source: latest/docs-ref-autogen/vm/diagnostics.yml
• Service: virtual-machines
• GitHub Login: @rloutlaw
• Microsoft Alias: routlaw

[yonzhan]

Compute

[zhoxing-ms]

--protected-settings : Json string or a file path containing private configurations
such as storage account keys, etc.

Because the value passed in by parameter --protected-settings is flexible, the value types other than storage account keys can be passed in. And there is no processing logic for --protected-settings in CLI, --protected-settings is directly sent to the REST service. Therefore, the verification logic of the special attribute storageAccountSasToken is not suitable to be added in CLI. @dainomat Please try to add the verification of --protected-settings in the script
Or we can consider contacting the service team to add this verification on server side.

[microsoft-github-policy-service]

🔔 Routing this issue to @act-observability-squad.