In Windows 365 you have the option to dynamically prepare your VMs, by leveraging Autopilot device preparation as shown in my post here: https://mikemdm.de/2025/06/15/windows-365-frontline-shared-and-autopilot-device-preparation/
What are your options if you want to deploy Images to AVD (Azure / Azure Local or even Hybrid) or to a locally running Hyper-V Machine on a laptop? Well, we are back at building golden images… While there are a ton of different options, I want to show you how you can use the Azure Image Builder which uses Packer to automate the image creation process. For me that approach has the big benefit that we can mostly reuse our existing Intune Win32 software packages to get a similar experience to what we are used to with Autopilot. In Part 1 we will cover the basics on how to get started and see our first image built.
Getting started
Resource Group
To create an Image Template for our Azure Image Builder, we will create a fresh Resource Group in our Subscription:
Storage Account
First thing that I would create in it is the storage account that we will use to store our apps and scripts.
I went with a premium storage account to speed up the download of our apps, but you can use a standard account as well, it will still work:
Unless you plan to run the Image Builder in your own VNET, we need to expose the storage account to public network. For this demo I will go with public network endpoints to make it easier:
Managed Identity
Next, we can create our User assigned managed identity, which will be used from the service to access your apps and scripts during built time:
Assign Permissions
Next, we need to grant the Managed Identity the permissions to create objects in the Resource Group:
Image Template
Now we can create our first Image Template:
I will go with a Windows 11 25H2 single session image from the Marketplace:
For now, I will go with a vhd file output, but you can also directly export to a Managed Image and or to a VM image version. Don’t forget to assign our Managed Identity as well:
On the next page, we can select our network options and define the SKU of the worker VM, depending on your requirement, it makes sense to select a “bigger” sku. Here we can also add our Managed Identity:
And our customizers like windows update, reboots, or scripts from our storage account. (Since we gave the managed identity the permission to access our storage account, we can add the script path directly)
On the next page we optionally can add additional validator scripts, which check the result of our previous steps:
And we can create our Template:
In that step, I would recommend to download the Azure RM Template as well, as we cannot change our settings once it is created (more in part 2):
Start the build process
The actual build process is simply started with the “Start build” play button:
In the Configuration Tab, we can verify our selected properties:
A few minutes (or hours depending on your customizers ;)) the build is hopefully finished:
Output
Our finished vhd image hides from us in the storage account in the temporary resource group created by the service:
In the storage account, it is in the vhd container:
Conclusion
I think the Azure Image Builder is a great service to build our custom images. In Part 2, I will show you how you can easily re-use your Intune Packages in the image template, how you can deploy the image template as Azure RM template from e.g. Azure DevOps for easier modification and how you can troubleshoot the image build process when something goes wrong.
Leave a Reply