Use Azure VM Image Builder to access an existing Azure virtual network
Article
Applies to: ✔️ Windows VMs
This article shows you how to use Azure VM Image Builder to create a basic, customized Windows image that has access to existing resources on a virtual network. The build virtual machine (VM) you create is deployed to a new or existing virtual network that you specify in your subscription. When you use an existing Azure virtual network, VM Image Builder doesn't require public network connectivity.
Set variables and permissions
For this task, you use some pieces of information repeatedly. Create some variables to store that information.
# Step 1: Import module
Import-Module Az.Accounts
# Step 2: get existing context
$currentAzContext = Get-AzContext
# destination image resource group
$imageResourceGroup="aibImageRG"
# location (see possible locations in main docs)
$location="westus2"
## if you need to change your subscription: Get-AzSubscription / Select-AzSubscription -SubscriptionName
# get subscription, this will get your current subscription
$subscriptionID=$currentAzContext.Subscription.Id
# name of the image to be created
$imageName="win2019image01"
# image distribution metadata reference name
$runOutputName="win2019ManImg02ro"
# image template name
$imageTemplateName="window2019VnetTemplate03"
# distribution properties object name (runOutput), i.e. this gives you the properties of the managed image on completion
$runOutputName="winSvrSigR01"
# VNET properties (update to match your existing virtual network, or leave as-is for demo)
# VNET name
$vnetName="myexistingvnet01"
# subnet name
$subnetName="subnet01"
# VNET resource group name
$vnetRgName="existingVnetRG"
# Existing Subnet NSG Name or the demo will create it
$nsgName="aibdemoNsg"
# NOTE! The virtual network must always be in the same region as the VM Image Builder service region.
If you don't have an existing virtual network, subnet, or network security group (NSG), use the following script to create one.
New-AzResourceGroup -Name $vnetRgName -Location $location
## Create base NSG to simulate an existing NSG
New-AzNetworkSecurityGroup -Name $nsgName -ResourceGroupName $vnetRgName -location $location
$nsg = Get-AzNetworkSecurityGroup -Name $nsgName -ResourceGroupName $vnetRgName
$subnet = New-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix "10.0.1.0/24" -PrivateLinkServiceNetworkPoliciesFlag "Disabled" -NetworkSecurityGroup $nsg
New-AzVirtualNetwork -Name $vnetName -ResourceGroupName $vnetRgName -Location $location -AddressPrefix "10.0.0.0/16" -Subnet $subnet
## NOTE! The virtual network must always be in the same region as the VM Image Builder service region.
Add an NSG rule
This rule allows connectivity from the VM Image Builder load balancer to the proxy VM. Port 60001 is for Linux, and port 60000 is for Windows. The proxy VM connects to the build VM by using port 22 for Linux, or port 5986 for Windows.
The image build for this example takes approximately 50 minutes (including multiple reboots and Windows updates). When you query the status, look for lastRunStatus. The following code shows that the build is still running. If it had completed successfully, it would show succeeded.
If you're distributing to a VHD location, need managed image location properties, or Azure Compute Gallery replications status, you need to query runOutput. Every time you have a distribution target, you will have a unique runOutput, to describe properties of the distribution type.
Remove-AzResourceGroup $imageResourceGroup -Force
# delete VNET created
# BEWARE! In this example, you have either used an existing virtual network or created one for this example. Do not delete your existing virtual network. If you want to delete the virtual network resource group used in this example '$vnetRgName', modify the preceding code.