diff --git a/release/tools/azure.conf b/release/tools/azure.conf
--- a/release/tools/azure.conf
+++ b/release/tools/azure.conf
@@ -19,20 +19,25 @@
 export VM_BOOTPARTSOFFSET=1M
 
 vm_extra_pre_umount() {
-	mount -t devfs devfs ${DESTDIR}/dev
-
-	# The firstboot_pkgs rc.d script will download the repository
-	# catalogue and install or update pkg when the instance first
-	# launches, so these files would just be replaced anyway; removing
-	# them from the image allows it to boot faster.
-	chroot ${DESTDIR} ${EMULATOR} env ASSUME_ALWAYS_YES=yes \
-		/usr/sbin/pkg delete -f -y pkg
-	rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports
-	rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports-kmods
-
-	chroot ${DESTDIR} ${EMULATOR} pw usermod root -h -
-
-	umount ${DESTDIR}/dev
+	# Remove the pkg package and repo databases as they will likely
+	# be out of date by the time the image is used.  In unprivileged
+	# builds this is unnecessary as pkg will not be installed to
+	# begin with.
+	if [ -z "${NO_ROOT}" ]; then
+		mount -t devfs devfs ${DESTDIR}/dev
+
+		# The firstboot_pkgs rc.d script will download the repository
+		# catalogue and install or update pkg when the instance first
+		# launches, so these files would just be replaced anyway; removing
+		# them from the image allows it to boot faster.
+		chroot ${DESTDIR} ${EMULATOR} env ASSUME_ALWAYS_YES=yes \
+			/usr/sbin/pkg delete -f -y pkg
+		umount ${DESTDIR}/dev
+		rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports
+		rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports-kmods
+	fi
+
+	pw -R ${DESTDIR} usermod root -h -
 
 	cat << EOF >> ${DESTDIR}/etc/rc.conf
 ifconfig_hn0="SYNCDHCP"
@@ -51,6 +56,7 @@
 mlx4en_load="YES"
 mlx5en_load="YES"
 EOF
+	metalog_add_data ./boot/loader.conf
 
 	return 0
 }