« SEO Tips and Tools (My Raw Notes) | Main | What Environment Variables Can You Use in Windows Azure? »

February 06, 2011

How to Deploy Windows Azure VM Role

For a project that I started in Windows Azure I needed access to the VM Role functionality and hence I decided to test the experience from customer point of view. Here are the steps I followed:

  1. Request access to the VM Role functionality in Windows Azure
  2. Preparing the VHD for VM Role 
  3. Upload the VHD in the VM Image Repository on Windows Azure
  4. Create a hosted service to host the VM Role
  5. Upload Windows Azure Hosted Service Certificate
  6. Create package and deploy the VM Role to the hosted service
  7. Remote Desktop to the VM Role and install additional software if needed

Request Access to VM Role Functionality on Windows Azure

As you may already know Windows Azure VM Role feature is still in beta, and in order to use it you need to request access to the feature. You can do this using the following steps:

  1. Go to Windows Azure Management Portal at http://windows.azure.com
  2. Login using your Live ID, and click on Beta Programs in the left-side navigation
  3. In the main pane you will see the list of Beta Programs that are available as well as checkboxes for each one
  4. Click on the checkbox next to VM Role and click on the button Join Selected

Windows Azure Beta Programs


After you complete this workflow you need to wait until your request gets approved. I had to wait approximately two weeks before I received notification that my request is approved. Keep in mind that each Beta Program has its own wait time because they have different quotas and are approved by different teams within Windows Azure. Those times can also change based on the number of requests received.

Important: Please read the notification email carefully! In the email you will find information how to enable VM Role features in the Visual Studio development environment. In essence you need to run one of the scripts below to add new registry key or just change the following [dword] registry key:

HKEY_CURRENT_USER\SOFTWARE\Wow6432Node\Microsoft\Windows Azure Tools for Microsoft Visual Studio 2010\1.0\VirtualMachineRoleEnabled​=1


The scripts above will enable the Add New Virtual Machine Role in the context menu in Visual Studio.


Preparing the VHD for Windows Azure VM Role

One important point I would like to emphasize when you prepare the VHD is the need to install the Windows Azure Integration Components. MSDN Library documentation is very explicit how you can do that using HyperV Manager.

Of course I don’t have the HyperV Manager on my Windows 7 machine and preparing the 64-bit image turned out to be a bit problematic (Note: At the moment Windows Azure supports only 64-bit VM Roles based on Windows Server 2008 R2).

The workaround I used was to install the Open Source VirtualBox software, and prepare the image with it. However you will need hardware virtualizations in order to create the 64-bit VHD.


Upload VHD Image to Windows Azure

The next thing you need to do is to upload the VHD file into Windows Azure image repository. I have created very simple VHD file with Windows 7 Ultimate using the Virtual PC in Windows 7.

In order to upload the VHD into the image repository you need to use the csupload.exe tool delivered as part of Windows Azure .Net SDK 1.3 or later. Here is how to use the tool:

  1. Open Windows Azure SDK Command Prompt as Administrator

  2. Execute the following command

    csupload Add-VMImage -Connection "SubscriptionId=[subscription_id]; CertificateThumbprint=[certificate_thumbprint]" -Description "[description]" -LiteralPath "[vhd_location]" –Name [vhd_filename] -Location "[azure_subregion]" -TempLocation %TEMP% -SkipVerify


    subscription_id is the ID of the Windows Azure subscription where you want your VHD to be placed
    certificate_thumbprint is the thumbprint for the management certificate uploaded in the above mentioned subscription. Note: This is the Management Certificate used to manage Windows Azure services for this subscription and NOT the Hosted Service certificate you will need later on when you deploy the VM Role. 
    description is user friendly description you want to use
    vhd_location is the location of the VHD on your local machine or network
    vhd_filename is the name of the VHD file
    azure_subregion is the Windows Azure sub-region (you can find the names of the sub-regions in every offer description on Windows Azure web site – look for Data Transfer Details and expand the section)

    Few notes related to the csupload.exe tool:
    1.) Make sure that you have write permissions to the vhd_location folder else the command will fail during verification. If you do not have write permissions to the location folder you can use the –SkipVerify option or specify –TempLocation as I did above
    2.) At the time of this writing there was an issue with verification on 32-bit Windows 7, and if you are trying to upload the VHD from 32-bit Windows 7 machine you may encounter some errors. In this case use the –SkipVerify option.

Depending of the size of your VHD and the upstream speed of your Internet connection you may need to wait a while until the upload is complete.

Once the VHD image is uploaded to Windows Azure you will see it in the image repository in the Management Portal.




Create a hosted service to host the VM Role

You create the Hosted Service for VM Role the same way you create Hosted Service for Web or Worker role. One important thing you need to remember is to create the hosted service in the same location where you have uploaded the VHD. If you forget to do so you will receive the following (very explanatory) error message at deploy time:


HTTP Status Code: 400
Error Message: A parameter was incorrect. Details: One of the specified images cannot be used for creating the deployment. When you want to create a deployment that is based on a machine image, one of the following constraints must be met: (1) the hosted service and the image belong to the same affinity group, or (2) neither the hosted service nor the image belong to an affinity group, but their location constraints are the same, or (3) the hosted service belongs to an affinity group and the image has a location constraint equal to the location constraint of the affinity group. Here are the details about the current deployment: Image [image_name] does not belong to an affinity group. Its location constraint is [vhd_location].Hosted service [hosted_service_name] is not in an affinity group. Its location constraint is [hosted_service_location].
Operation Id: [some_operation_id]


I am not going to describe the Hosted Service creation process in details – you can do this quite easy from Windows Azure Management Portal.


Upload the Hosted Service Certificate


Before deploying VM Role you will need to upload Hosted Service Certificate (also used to enable SSL communication to your endpoint). Here is how you do that:

  1. In Windows Azure Management Portal select the Hosted Services, Storage Accounts and CDN tab and then Hosted Services in the top left navigation
  2. In the main pane expand the Hosted Service, into which you want to upload the certificate and select the Certificates

  3. Click on the Add Certificate button in the ribbon

  4. Browse for the certificate locally and type the password for it

Create Package and Deploy the VM Role to Windows Azure

In order to deploy the VM Role to Windows Azure you need to create a CSPKG package and CSCFG for your application and deploy those to the hosted service you created in the previous step. Here is how to do that:

  1. In Visual Studio 2010 create a new Windows Azure Project

  2. In the next step in the wizard it is important that you DO NOT create any Windows Azure Role – thus the project will only have CSPKG and CSCFG files created and no separate projects for the roles

  3. Now that you have the project and have changed the Visual Studio configuration to show the Add->New Virtual Machine Role option you can click on the Roles node (or the Project node) in the project and add the VM Role

  4. If you don’t have your Windows Azure account configured in Visual Studio you will need to do that first. You will need to use the same subscription you used to upload the VHD file for this configuration.

  5. If you have your Windows Azure account already configured you can select the VHD from the drop down menu

  6. In the configuration tab you can change the number of instances you want to have for the VM Role
  7. You can also add endpoint for the VM Role and make it accessible from outside. I personally enabled port 80 and port 8080 for my test role

  8. Once you are done with the configuration right-click on the project and select Publish


    You will see the publish dialog: 

  9. Configure Remote Desktop for all the instances by clicking on the link right above the buttons


    Note: The certificate you choose in this window MUST be the same you uploaded to your Hosted Service in the previous section.
  10. Click on the OK button and wait until the deployment is complete 

  11. Once the deployment is done you can see your VM Role running in Windows Azure Management Portal


Remote Desktop to VM Role

You can Remote Desktop to the Windows Azure VM Role from Windows Azure Management Portal by selecting the instance you want to remote to and clicking on the Connect button in the ribbon:




You will be asked for the username and password – you should use the ones that you set up in step 9. in the section Create Package and Deploy the VM Role above. You may need to specify the machine name before the user name in order to login into the system – if you don’t have the actual machine name you can use the Hosted Service name and it will work:




I already had all the software installed on my VM and didn’t need to do any other installations.


Hope this step-by-step guide will help you bootstrap your Windows Azure VM Role deployment.


Feed You can follow this conversation by subscribing to the comment feed for this post.

Lucian Daia

Thanks for the walkthrough! It seems like Microsoft forgot to mentions that the VM Role will not show up b y default in Visual Studio so I went about reinstalling Windows Azure Tools for visual Studio about 4 times.


@Lucian: It is part of the email you receive after your request is approved but honestly I didn't read the email and had the same problem :)

Rick McKnight

Appreciate the effort to put together such detailed info.

However, I read that you cannot realistically use an Azure VM role to run Active Directory, because it does not take kindly to be being reverted to an earlier state.

what's your opinion on that?



You are correct - at the moment you cannot deploy AD on Azure because the changes you make to the VM while running are not persistent. I don't think I can give you workaround at the moment but in the future this should be solved.


Hi, I configured and uploaded vhd to Windows Azure, but I have a problem with Remote Desktop Connection. When I try to connect, I get the "Your account has been disabled. Please see your system administrator". Do you know how I can resolve it ?


@Siyudyk: First, I have to ask you whether you followed the instructions to configure Remote Desktop as part of the package? If so, you can try to reset the username and the password from Windows Azure Management Portal - just click on Configure button next to Connect.

Let me know if you are still experiencing problems.


After deployed the VM role. I decided to add a website to IIS, and a SSL certificate to associated with that website. How can I do that? All I can find is how to install a SSL certificate before deployment(upload VHD)!!!


VM role image has to be sysprep-ed before upload. A Windows Image can only be sysprep-ed for a limited number of times(3?), after that the image will not work any more, so VM Role is not a proper platform for an application needs frequent updates. Also problematic to add SSL certificate if you do not plan ahead.


Yes, you need to install the certificate before you upload the VHD to Windows Azure. If you install the cert after that you will lose it if your VM role gets moved to another node.
Regarding the sysprep you don't need to change the base image but can use diff images for the updates.

Post a comment

Comments are moderated, and will not appear on this weblog until the author has approved them.

If you have a TypeKey or TypePad account, please Sign In