title: Azure pipeline 'WinRMCustomScriptExtension' underlying connection was closed in non-public VM
body: <p>In Azure pipeline when creating a VM through deployment template, we have the option to 'Configure with WinRM agent' as given below. <a href="https://i.stack.imgur.com/cmgkE.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/cmgkE.png" alt="Configure with WinRM agent"></a></p>
  
  <p>This acts as a custom extension behind the scenes. But the downloading of this custom extension can be blocked by an internal vnet in Azure. This is the error we are getting.</p>
  
  <pre><code>&lt;datetime&gt; Adding extension 'WinRMCustomScriptExtension' on virtual machine &lt;vmname&gt;
  &lt;datetime&gt; Failed to add the extension to the vm: &lt;vmname&gt;. Error: "VM has reported a failure when processing extension 'WinRMCustomScriptExtension'. Error message: \"Failed to download all specified files. Exiting. Error Message: The underlying connection was closed: An unexpected error occurred on a send.\"\r\n\r\nMore information on troubleshooting is available at https://aka.ms/VMExtensionCSEWindowsTroubleshoot "
  </code></pre>
  
  <p>Since the files cannot be downloaded, I am thinking of a couple of solutions:</p>
  
  <ol>
  <li>How can I know which powershell files azure is using to setup winrm?</li>
  <li>Location to store files would be storage account (same vnet as VM)</li>
  <li>Perhaps not use WinRM at all and use custom script extension to resolve
  everything (with all files from storage account). I hope error from extension stops the pipeline if it happens.</li>
  <li>Is there a better solution to resolve this? To me it looks like a bad design by azure as it is not covering non-public VMs.</li>
  </ol>
  
  <p>EDIT:
  Found answer to #1) <a href="https://aka.ms/vstsconfigurewinrm" rel="nofollow noreferrer">https://aka.ms/vstsconfigurewinrm</a>. This was shown in Raw logs of the pipeline when diagnostics were enabled</p>