diff --git a/src/ApiService/ApiService/onefuzzlib/Extension.cs b/src/ApiService/ApiService/onefuzzlib/Extension.cs
index 29a3bfbd7d..351c7930f0 100644
--- a/src/ApiService/ApiService/onefuzzlib/Extension.cs
+++ b/src/ApiService/ApiService/onefuzzlib/Extension.cs
@@ -267,7 +267,8 @@ public async Async.Task<VMExtensionWrapper> AgentConfig(AzureLocation region, Os
         await UpdateManagedScripts();
         var urlsUpdated = urls ?? new();
 
-        var managedIdentity = JsonSerializer.Serialize(new { ManagedIdentity = new Dictionary<string, string>() }, _extensionSerializerOptions);
+        var managedIdentity = withSas ? null : new BinaryData(JsonSerializer.Serialize(new { ManagedIdentity = new Dictionary<string, string>() }, _extensionSerializerOptions));
+
         if (vmOs == Os.Windows) {
             var vmScripts = await ConfigUrl(WellKnownContainers.VmScripts, "managed.ps1", withSas) ?? throw new Exception("failed to get VmScripts config url");
             var toolsAzCopy = await ConfigUrl(WellKnownContainers.Tools, "win64/azcopy.exe", withSas) ?? throw new Exception("failed to get toolsAzCopy config url");
@@ -290,7 +291,7 @@ public async Async.Task<VMExtensionWrapper> AgentConfig(AzureLocation region, Os
                 TypeHandlerVersion = "1.9",
                 AutoUpgradeMinorVersion = true,
                 Settings = new BinaryData(JsonSerializer.Serialize(new { commandToExecute = toExecuteCmd, fileUris = urlsUpdated }, _extensionSerializerOptions)),
-                ProtectedSettings = new BinaryData(managedIdentity)
+                ProtectedSettings = managedIdentity
             };
             return extension;
         } else if (vmOs == Os.Linux) {
@@ -315,7 +316,7 @@ public async Async.Task<VMExtensionWrapper> AgentConfig(AzureLocation region, Os
                 ForceUpdateTag = Guid.NewGuid().ToString(),
                 AutoUpgradeMinorVersion = true,
                 Settings = new BinaryData(extensionSettings),
-                ProtectedSettings = new BinaryData(managedIdentity)
+                ProtectedSettings = managedIdentity
             };
             return extension;
         }
diff --git a/src/ApiService/ApiService/onefuzzlib/ReproOperations.cs b/src/ApiService/ApiService/onefuzzlib/ReproOperations.cs
index c775e418d5..625c78fb6e 100644
--- a/src/ApiService/ApiService/onefuzzlib/ReproOperations.cs
+++ b/src/ApiService/ApiService/onefuzzlib/ReproOperations.cs
@@ -185,7 +185,6 @@ public async Async.Task<Repro> ExtensionsLaunch(Repro repro) {
                     ErrorCode.VM_CREATE_FAILED,
                     new string[] { "failed before launching extensions" }));
         }
-
         if (vmData.ProvisioningState == "Failed") {
             var failedVmData = await _context.VmOperations.GetVmWithInstanceView(vm.Name);
             if (failedVmData is null) {
diff --git a/src/ApiService/ApiService/onefuzzlib/VmOperations.cs b/src/ApiService/ApiService/onefuzzlib/VmOperations.cs
index d907dfd1d2..e5cb3130e8 100644
--- a/src/ApiService/ApiService/onefuzzlib/VmOperations.cs
+++ b/src/ApiService/ApiService/onefuzzlib/VmOperations.cs
@@ -152,7 +152,6 @@ public async System.Threading.Tasks.Task DeleteVm(string name) {
         return;
     }
 
-
     public async Task<OneFuzzResult<bool>> AddExtensions(Vm vm, Dictionary<string, VirtualMachineExtensionData> extensions) {
         var statuses = new List<(string extName, string state)>();
         var toCreate = new List<KeyValuePair<string, VirtualMachineExtensionData>>();
@@ -212,7 +211,6 @@ public async Task<OneFuzzResultVoid> Create(Vm vm) {
             var vm = await _context.Creds.GetResourceGroupResource().GetVirtualMachineAsync(
                 vmName
             );
-
             return (await vm.Value.GetVirtualMachineExtensionAsync(extensionName)).Value.Data;
         } catch (RequestFailedException ex) {
             _logTracer.Info($"extension does not exist {ex.Message:Tag:Error}");