Execution of CSE during VM upgrade or VM reimage

I hope this is the right place to ask for our question.

We are currently running the following setup: We have configured a VMSS with a Linux custom script extension that contains a short lived access token. Upon VM creation the custom script extension is run and authenticates with this token against an external API.

As the token expires every hour, we are updating the VMSS via a cron job with a new valid token. Once the VMSS is updated, we also need to update the VMs to the latest model. What we have seen is that when running an "VM upgrade" the CSE is only executed sometimes. Do you know what triggers the execution in case of a "VM upgrade"?

Additionally, we need to reset the VM to its inital state and therefore we are using "VM reimage" command. Is there a possibility to Upgrade the VM and Reimage the VM at the same time? We are currently first doing a "VM upgrade" and then a "VM reimage". However, this sometimes leads to a duplicate execution of the CSE which is not what we want.

Looking forward for any ideas or suggestions!

The issue names no repository file, test, or entry point. Start by investigating the Linux custom script extension behavior during Azure VMSS model upgrades and reimages; done would require a documented, reproducible execution rule and a clear answer on whether both operations can be combined without duplicate execution.

Written by the indexing model from the issue text.