This post will discuss what Azure Active Directory Authentication for Azure Linux virtual machines is, how to configure it, and how to login.
Note that this is a preview feature. Most of the time, preview features are supported for production workloads but this time, Microsoft has stated:
This feature is in preview and is not recommended for use with production virtual machines or workloads. Use this feature on a test virtual machine that you expect to discard after testing.
It is a cool new feature and it is worth having a look at. At this time, it only works with the following Linux distributions but in all regions, except for the sovereign/government clouds:
Windows Server support is scheduled for later this year.
Microsoft’s documentation explains how you can deploy the setting using CLI (an alternative to PowerShell) but it is possible to deploy using the Azure Portal, as I will show here.
Normally you sign into a Linux virtual machine using a local username with a password or SSH key. It is possible to join machines to a central authority, such as Active Directory Domain Services (or Azure AD Domain Services), but Active Directory is not always suitable. With this new preview feature, you can get server/application administrators/developers to sign in using their corporate credentials via Azure AD without any kind of domain join. Benefits include:
An extension (AADLoginForLinux) is installed in the virtual machine to enable integration with Azure AD.
To be able to sign into a virtual machine, an administrator’s or user’s account (or a group they are a member of) must have been granted access via Role-Based Access Control – being an owner/contributor over the virtual machine is not enough!
There are two ways that you can deploy the AADLoginForLinux extension into an Azure virtual machine. The first is to enable it in the Basics blade while creating the virtual machine:
Another option is to add the AADLoginForLinux extension to an existing Linux virtual machine using CLI. The easiest way to run CLI is to launch the (Linux) Cloud Shell from the Azure Portal – click the >_ button in the top-right of the portal. Then run the following command, swapping your virtual machine name and its resource group name:
az vm extension set --publisher Microsoft.Azure.ActiveDirectory.LinuxSSH --name AADLoginForLinux --resource-group petri --vm-name vm-linux-01
It will take a minute or two for this installation to complete.
You will need to grant people rights to sign into the virtual machine. This is the case even for subscription owners and contributors because being a subscription owner doesn’t mean you should have rights to the guest OS!
Authentication is done using Azure AD user accounts/group and resource permissions. Since the days of Windows NT, the best way to do permissions is users > groups > permission. I have created a group with some member users.
You can assign permissions at three levels:
In my example, I will set permissions at the resource group level. I have opened the resource group that contains my Linux virtual machines and clicked Access Control (IAM). A popup blade called Add Permissions appears when I click + Add.
There are two possible roles/permissions that I can grant:
In my example, I am granting Virtual Machine Administrator Login rights to the group that I created earlier:
When I attempt to sign into the Linux virtual machine now, I can use my Azure AD user account. This can be seen in the login command that the Connect To Virtual Machine popup blade shares when you click Connect in a Linux virtual machine’s blade.
I am using PuTTY in my example. When the Sign In prompt appears in the SSH session, I will enter my Azure AD username. At this time, I am prompted to browse to https://microsoft.com/devicelogin and enter a one-time code. I will then be asked to sign into Azure AD (your Azure sign-in) if I am not already signed in.
I was already signed into the browser because I had a tab open in the Azure Portal. I didn’t have to enter my password at all!
Once I am signed in, I can close the browser tab and press Enter in the SSH session. I will be signed into the Linux guest OS at that point: