# crowdstrike/azure-vm-extension architecture

> Architecture diagram of the GitHub repository crowdstrike/azure-vm-extension, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/crowdstrike/azure-vm-extension
- Repository: https://github.com/crowdstrike/azure-vm-extension

## Overview

This repository provides the CrowdStrike Falcon sensor Azure VM Extension: Azure invokes a platform-specific handler, which obtains a sensor package, runs the installer, and reports status. It also includes ARM deployment templates and Azure Policy templates for deploying the extension at scale. The source excerpts were unavailable, so runtime links follow the README’s documented flow; implementation-level call details are not inferred.

Main entry points: [`linux/handler`](https://github.com/crowdstrike/azure-vm-extension/tree/main/linux/handler) (Linux lifecycle handler), [`windows/handler`](https://github.com/crowdstrike/azure-vm-extension/tree/main/windows/handler) (Windows lifecycle handler), [`linux/package`](https://github.com/crowdstrike/azure-vm-extension/tree/main/linux/package) (Linux VM template), [`linux/package-arc`](https://github.com/crowdstrike/azure-vm-extension/tree/main/linux/package-arc) (Linux Arc template)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_deployment["Azure deployment"]
  node_linux_vm_template["Linux VM template"]
  node_linux_arc_template["Linux Arc template"]
  node_windows_vm_template["Windows VM template"]
  node_windows_arc_template["Windows Arc template"]
  node_policy_subscription["Subscription policy"]
  node_policy_management["Management group policy"]
end

subgraph group_linux["Linux handler"]
  node_linux_handler["Linux lifecycle handler"]
end

subgraph group_windows["Windows handler"]
  node_windows_handler["Windows lifecycle handler"]
end

subgraph group_integrations["External integrations"]
  node_falcon_api["CrowdStrike API"]
  node_key_vault[("Azure Key Vault")]
  node_sensor_package["Falcon sensor package"]
  node_falcon_installer["Falcon installer"]
  node_azure_portal["Azure status portal"]
end

node_operator(("Deployment operator"))
node_azure["Azure VM extension"]

node_operator -->|"deploys extension"| node_azure
node_operator -->|"selects deployment"| node_linux_vm_template
node_operator -->|"selects deployment"| node_linux_arc_template
node_operator -->|"selects deployment"| node_windows_vm_template
node_operator -->|"selects deployment"| node_windows_arc_template
node_operator -->|"applies policy"| node_policy_subscription
node_operator -->|"applies policy"| node_policy_management
node_azure -->|"invokes lifecycle"| node_linux_handler
node_azure -->|"invokes lifecycle"| node_windows_handler
node_linux_handler -->|"requests sensor"| node_falcon_api
node_windows_handler -->|"requests sensor"| node_falcon_api
node_falcon_api -->|"provides package"| node_sensor_package
node_linux_handler -->|"executes installer"| node_falcon_installer
node_windows_handler -->|"executes installer"| node_falcon_installer
node_linux_handler -.->|"retrieves credentials"| node_key_vault
node_windows_handler -.->|"retrieves credentials"| node_key_vault
node_linux_handler -->|"reports status"| node_azure_portal
node_windows_handler -->|"reports status"| node_azure_portal

click node_linux_handler "https://github.com/crowdstrike/azure-vm-extension/tree/main/linux/handler"
click node_windows_handler "https://github.com/crowdstrike/azure-vm-extension/tree/main/windows/handler"
click node_linux_vm_template "https://github.com/crowdstrike/azure-vm-extension/tree/main/linux/package"
click node_linux_arc_template "https://github.com/crowdstrike/azure-vm-extension/tree/main/linux/package-arc"
click node_windows_vm_template "https://github.com/crowdstrike/azure-vm-extension/tree/main/windows/package"
click node_windows_arc_template "https://github.com/crowdstrike/azure-vm-extension/tree/main/windows/package-arc"
click node_policy_subscription "https://github.com/crowdstrike/azure-vm-extension/blob/main/policy/falcon-subscription.bicep"
click node_policy_management "https://github.com/crowdstrike/azure-vm-extension/blob/main/policy/falcon-managementgroup.bicep"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_linux_vm_template,node_linux_arc_template,node_windows_vm_template,node_windows_arc_template,node_policy_subscription,node_policy_management toneBlue
class node_linux_handler toneAmber
class node_windows_handler toneMint
class node_falcon_api,node_key_vault,node_sensor_package,node_falcon_installer,node_azure_portal toneRose
class node_operator,node_azure toneIndigo
```

## Components

### Azure deployment

- [Linux VM template](https://github.com/crowdstrike/azure-vm-extension/tree/main/linux/package): `linux/package`
- [Linux Arc template](https://github.com/crowdstrike/azure-vm-extension/tree/main/linux/package-arc): `linux/package-arc`
- [Windows VM template](https://github.com/crowdstrike/azure-vm-extension/tree/main/windows/package): `windows/package`
- [Windows Arc template](https://github.com/crowdstrike/azure-vm-extension/tree/main/windows/package-arc): `windows/package-arc`
- [Subscription policy](https://github.com/crowdstrike/azure-vm-extension/blob/main/policy/falcon-subscription.bicep): `policy/falcon-subscription.bicep`
- [Management group policy](https://github.com/crowdstrike/azure-vm-extension/blob/main/policy/falcon-managementgroup.bicep): `policy/falcon-managementgroup.bicep`

### Linux handler

- [Linux lifecycle handler](https://github.com/crowdstrike/azure-vm-extension/tree/main/linux/handler): `linux/handler`

### Windows handler

- [Windows lifecycle handler](https://github.com/crowdstrike/azure-vm-extension/tree/main/windows/handler): `windows/handler`

### External integrations

- **CrowdStrike API**
- **Azure Key Vault**
- **Falcon sensor package**
- **Falcon installer**
- **Azure status portal**

### Other components

- **Deployment operator**
- **Azure VM extension**

## Connections

- Deployment operator → Azure VM extension: deploys extension
- Deployment operator → Linux VM template: selects deployment
- Deployment operator → Linux Arc template: selects deployment
- Deployment operator → Windows VM template: selects deployment
- Deployment operator → Windows Arc template: selects deployment
- Deployment operator → Subscription policy: applies policy
- Deployment operator → Management group policy: applies policy
- Azure VM extension → Linux lifecycle handler: invokes lifecycle
- Azure VM extension → Windows lifecycle handler: invokes lifecycle
- Linux lifecycle handler → CrowdStrike API: requests sensor
- Windows lifecycle handler → CrowdStrike API: requests sensor
- CrowdStrike API → Falcon sensor package: provides package
- Linux lifecycle handler → Falcon installer: executes installer
- Windows lifecycle handler → Falcon installer: executes installer
- Linux lifecycle handler → Azure Key Vault: retrieves credentials
- Windows lifecycle handler → Azure Key Vault: retrieves credentials
- Linux lifecycle handler → Azure status portal: reports status
- Windows lifecycle handler → Azure status portal: reports status