AZ_VM_ADMIN_LOGIN

Summary

Forestall ACL Alias	AZ_VM_ADMIN_LOGIN
Azure Alias	Virtual Machine Administrator Login (Azure RBAC)
Affected Object Types	Virtual Machines
Exploitation Certainty	Certain
Azure RBAC Role	Virtual Machine Administrator Login (1c0163c0-47e6-4577-8991-ea5c82e286e4) - login to a virtual machine as administrator

Note: This role requires the VM to have the Microsoft Entra login extension installed and a system-assigned managed identity. It grants interactive RDP/SSH login with local administrator privileges using Microsoft Entra credentials.

Description

AZ_VM_ADMIN_LOGIN represents the Azure RBAC Virtual Machine Administrator Login role assignment. This data-plane role grants interactive login access to Azure VMs as a local administrator using Microsoft Entra ID credentials.

Prerequisites for this role to be effective:

• The VM must have the Microsoft Entra login extension installed (AADLoginForWindows for Windows VMs or AADSSHLoginForLinux for Linux VMs).

• The VM must have a system-assigned managed identity enabled.

• Network connectivity must allow RDP (3389) or SSH (22) access.

This is distinct from AZ_EXECUTE_COMMAND which uses the RunCommand API - AZ_VM_ADMIN_LOGIN provides direct interactive shell access.

Identification

PowerShell (Az Module)

Connect-AzAccount

# List all Virtual Machine Administrator Login role assignments
Get-AzRoleAssignment -RoleDefinitionName "Virtual Machine Administrator Login" |
    Select-Object DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

# Check specific VM for admin login assignments
Get-AzRoleAssignment -Scope "/subscriptions/<SubId>/resourceGroups/<RGName>/providers/Microsoft.Compute/virtualMachines/<VMName>" |
    Where-Object { $_.RoleDefinitionName -eq "Virtual Machine Administrator Login" } |
    Select-Object DisplayName, RoleDefinitionName, ObjectType |
    Format-Table -AutoSize

# Verify the Microsoft Entra login extension is installed on a VM
Get-AzVMExtension -ResourceGroupName "<RGName>" -VMName "<VMName>" |
    Where-Object { $_.Name -match "AAD" } |
    Select-Object Name, Publisher, ExtensionType |
    Format-Table -AutoSize

Azure Portal

1. Open Azure Portal -> navigate to the target Virtual Machine.

2. Go to Access control (IAM) -> Role assignments.

3. Filter by Role = Virtual Machine Administrator Login.

4. Review all principals listed.

5. Verify the Microsoft Entra login extension under Extensions + applications.

Exploitation

For detailed exploitation steps, refer to the following edges based on the target VM type:

• Windows VMs: See AZ_RDP for RDP exploitation with Entra ID credentials.

• Linux VMs: See AZ_SSH for SSH exploitation with Entra ID credentials.

Mitigation

1. Review and Remove Login Role Assignments

   • Navigate to Azure Portal -> Virtual Machine -> Access control (IAM).

   • Click Role assignments tab.

   • Filter by role: Virtual Machine Administrator Login.

   • Select unnecessary assignments -> click Remove.

2. Remove Microsoft Entra login extension

   • Navigate to Azure Portal -> Virtual Machine -> Extensions + applications.

   • Select AADLoginForWindows or AADSSHLoginForLinux extension.

   • Click Uninstall to disable Entra-based login authentication.

3. Restrict RDP/SSH Access via Network Security Group

   • Navigate to Azure Portal -> Virtual Machine -> Networking -> Network settings.

   • Under Inbound port rules, find any rules allowing port 3389 (RDP) or 22 (SSH).

   • Click the rule -> modify Source to restrict to specific IPs or remove the rule entirely.

4. Enable Just-in-Time VM Access

   • Navigate to Azure Portal -> Microsoft Defender for Cloud -> Workload protections.

   • Click Just-in-time VM access.

   • Select the VM -> click Enable JIT on VM.

   • Configure allowed ports, source IPs, and time windows.

5. Deploy Azure Bastion (Recommended)

   • Navigate to Azure Portal -> Virtual Machine -> Connect.

   • Select Bastion -> click Deploy Bastion if not already configured.

   • Once deployed, connect via Bastion to avoid exposing RDP/SSH publicly.

Detection

Use the Azure Portal and Microsoft Entra admin center:

1. In Azure Portal, open the target Virtual Machine.

2. Open Activity log and filter Operation for login or loginAsAdmin.

3. Review Microsoft.Compute/virtualMachines/login/action and Microsoft.Compute/virtualMachines/loginAsAdmin/action events.

4. Open Microsoft Entra ID -> Sign-in logs and filter Application for Azure Linux VM Sign-In or Azure Windows VM Sign-In.

5. Review User, IP address, Location, Date, and Status for unexpected VM admin logins.

6. On the VM blade, open Monitoring -> Metrics and review Network In and Network Out during the same timeframe.

References

• https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-administrator-login

• https://learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-windows

• https://learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-linux

• https://blog.netspi.com/abusing-azure-ad-single-sign-on-for-ec2-access/