As a third option, there is a way to run PowerShell DSC extensions on your VM:

DSC is a powerful solution to declaratively define a configuration for a VM using a JSON file, and PowerShell DSC makes sure that it will be configured as defined and--if you want it like that--it will be mandatory. This means that if somebody were to change it to something else, the system would automatically change it back.

Samples from real-world DSC configurations could be as follows:

• Enabling roles or features on your VM
• Setting network configurations (such as IP address, gateway, and static routes)
• Installing third-party software (such as your company's defined security solution)

The requirement for DSC is an operating system that supports Windows Management Framework (WMF) 4.0 or 5.0.

The DSC extension for Windows VMs uses the Azure Agent VM framework to interact with and report on DSC configurations. A DSC extension itself is a .zip file that contains the configuration document and the parameters provided by the Azure PowerShell SDK or the Azure portal itself.

To get a full list of Azure VM extensions, the following PowerShell will help:

    Get-AzureRmVmImagePublisher -Location local | `
    Get-AzureRmVMExtensionImageType | `
    Get-AzureRmVMExtensionImage | Select Type, Version  

The output should look something like this:

As only one extension per VM is possible, you will have to use nesting to add more than one. A sample of template nesting is as follows:

This is how it looks:

To work with nested templates, you will have to run the following steps:

1. Create the corresponding PowerShell scripts.
2. Create the parent ARM template.
3. Create the nested ARM template.
4. Upload the PowerShell scripts.
5. Upload nested ARM template.
6. Execute the PowerShell deployment script.

As you may have seen before, DSC is a powerful toolset to define a configuration inside a VM in the same way you do with ARM templates: the declarative way. The options that are available with DSC are unbelievable. It starts with setting up roles and features of a VM, comes to configuration tasks, and goes on to setting up and configuring third-party software, as soon as it provides a way for scripting.