Download a Linux VHD from Azure

Applies to: ✔️ Linux VMs ✔️ Flexible scale sets

This article describes how to download a Linux virtual hard disk (VHD) file from Azure. To download a VHD, the disk can't be attached to a running VM, which means the VM experiences downtime. Some configurations can safely avoid downtime by snapshotting the disk and downloading the VHD from the snapshot.

If you're using Microsoft Entra ID to control resource access, you can use it to restrict uploading of Azure Managed Disks. For more information, see Secure downloads and uploads of Azure Managed Disks.

Stop the VM

You can't download a VHD from Azure if the VHD is attached to a running VM. If you want to keep the VM running, you can create a snapshot and then download the snapshot.

To stop the VM:

Sign in to the Azure portal.
On the left menu, select Virtual Machines.
Select the VM from the list.
On the page for the VM, select Stop.

Once the VM is stopped,

Alternative: Snapshot the VM disk

Note

If feasible, stop a VM before taking a snapshot of it. Otherwise, the snapshot isn't clean. Snapshots of running VMs are in the same state as if their VMs were power cycled or crashed when you take a snapshot. Usually, this state is safe but it could cause problems if the running applications at the time aren't crash resistant.

Generally, you should only use snapshots of running VMs if the only disk associated with them is a single OS disk. If a VM has one or more data disks, stop the VM before creating a snapshot of the OS or data disks.

Take a snapshot of the disk to download.

Select the VM in the portal.
Select Disks in the left menu and then select the disk you want to snapshot. The details of the disk are displayed.
Select Create Snapshot from the menu at the top of the page. The Create snapshot page opens.
In Name, type a name for the snapshot.
For Snapshot type, select Full or Incremental.
When you're done, select Review + create.

After you create your snapshot, you can use it to download a VHD or create another VM.

Generate SAS URL

To download the VHD file, you need to generate a shared access signature (SAS) URL. When the URL is generated, an expiration time is assigned to the URL.

Important

On February 15th, 2025, the Shared Access Signature (SAS) access time for disks and snapshots will be limited to a maximum of 60 days. Trying to generate a SAS with an expiration longer than 60 days results in an error. Any existing disk or snapshot SAS created with an expiration longer than 60 days may stop working 60 days after the date of creation and will result in a 403 error during authorization.

If a managed disk or snapshot SAS's expiration is longer than 60 days, revoke its access, and generate a new SAS that requests access for 60 days (5,184,000 seconds) or less. Improve your overall security by using SAS with shorter expiration dates. Make these changes before February 15, 2025 to prevent service interruption. The following links can be used to find, revoke, and request a new SAS.

To check if a disk has an active SAS, you can either use the REST API, the Azure CLI, or the Azure PowerShell module, and examine the DiskState property.
To revoke a SAS, you can use either the REST API, the Azure CLI, or the Azure PowerShell module.
To create a SAS, you can use either the REST API, the Azure CLI, or the Azure PowerShell module, and set the access duration to 5,184,000 seconds or less.

On the menu of the page for the VM, select Disks.
Select the operating system disk for the VM, and then select Disk Export.
If necessary, update the value of URL expires in (seconds) to give you enough time to complete the download. The default is 3,600 seconds (one hour).
Select Generate URL.

$diskSas = Grant-AzDiskAccess -ResourceGroupName "yourRGName" -DiskName "yourDiskName" -DurationInSecond 86400 -Access 'Read'

az disk grant-access --duration-in-seconds 86400 --access-level Read --name yourDiskName --resource-group yourRGName

Download VHD

Note

If you're using Microsoft Entra ID to secure managed disk downloads, the user downloading the VHD needs the appropriate RBAC permissions.

Under the generated URL, select Download the VHD file.
You might need to select Save in the browser to start the download. The default name for the VHD file is abcd.

Use the following script to download your VHD:

Connect-AzAccount -Environment AzureChinaCloud
#Set localFolder to your desired download location
$localFolder = "yourPathHere"
$blob = Get-AzStorageBlobContent -Uri $diskSas.AccessSAS -Destination $localFolder -Force

When the download finishes, revoke access to your disk by using Revoke-AzDiskAccess -ResourceGroupName "yourRGName" -DiskName "yourDiskName".

Replace yourPathhere and sas-URI with your values. Then, use the following script to download your VHD:

Note

If you're using Microsoft Entra ID to secure your managed disk uploads and downloads, add --auth-mode login to az storage blob download.


#set localFolder to your desired download location
localFolder=yourPathHere
#If you're using Azure AD to secure your managed disk uploads and downloads, add --auth-mode login to the following command.
az storage blob download -f $localFolder --blob-url "sas-URI"

When the download finishes, revoke access to your disk by using az disk revoke-access --name diskName --resource-group yourRGName.

Next steps

Learn how to upload and create a Linux VM from custom disk with the Azure CLI.
Manage Azure disks the Azure CLI.

Last updated on 2026-03-10

Download a Linux VHD from Azure

Stop the VM

Alternative: Snapshot the VM disk

Generate SAS URL

Download VHD

Next steps

Additional resources