Skip to content
Forestall

AZ_VM_ADMIN_LOGIN

Copy page

Summary
Forestall ACL Alias AZ_VM_ADMIN_LOGIN
Azure Alias Virtual Machine Administrator Login (Azure RBAC)
Affected Object Types Virtual Machines
Exploitation Certainty Certain
Azure RBAC Role Virtual Machine Administrator Login (1c0163c0-47e6-4577-8991-ea5c82e286e4) - login to a virtual machine as administrator

Note: This role requires the VM to have the Microsoft Entra login extension installed and a system-assigned managed identity. It grants interactive RDP/SSH login with local administrator privileges using Microsoft Entra credentials.

Description

AZ_VM_ADMIN_LOGIN represents the Azure RBAC Virtual Machine Administrator Login role assignment. This data-plane role grants interactive login access to Azure VMs as a local administrator using Microsoft Entra ID credentials.

Prerequisites for this role to be effective:

  • The VM must have the Microsoft Entra login extension installed (AADLoginForWindows for Windows VMs or AADSSHLoginForLinux for Linux VMs).
  • The VM must have a system-assigned managed identity enabled.
  • Network connectivity must allow RDP (3389) or SSH (22) access.

This is distinct from AZ_EXECUTE_COMMAND which uses the RunCommand API - AZ_VM_ADMIN_LOGIN provides direct interactive shell access.

Identification

PowerShell (Az Module)

Connect-AzAccount


# List all Virtual Machine Administrator Login role assignments
Get-AzRoleAssignment -RoleDefinitionName "Virtual Machine Administrator Login" |
    Select-Object DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize


# Check specific VM for admin login assignments
Get-AzRoleAssignment -Scope "/subscriptions/<SubId>/resourceGroups/<RGName>/providers/Microsoft.Compute/virtualMachines/<VMName>" |
    Where-Object { $_.RoleDefinitionName -eq "Virtual Machine Administrator Login" } |
    Select-Object DisplayName, RoleDefinitionName, ObjectType |
    Format-Table -AutoSize


# Verify the Microsoft Entra login extension is installed on a VM
Get-AzVMExtension -ResourceGroupName "<RGName>" -VMName "<VMName>" |
    Where-Object { $_.Name -match "AAD" } |
    Select-Object Name, Publisher, ExtensionType |
    Format-Table -AutoSize

Exploitation

For detailed exploitation steps, refer to the following edges based on the target VM type:

  • Windows VMs: See AZ_RDP for RDP exploitation with Entra ID credentials.
  • Linux VMs: See AZ_SSH for SSH exploitation with Entra ID credentials.

Mitigation

  1. Review and Remove Login Role Assignments

    • Navigate to Azure Portal -> Virtual Machine -> Access control (IAM).
    • Click Role assignments tab.
    • Filter by role: Virtual Machine Administrator Login.
    • Select unnecessary assignments -> click Remove.

  2. Remove Microsoft Entra login extension

    • Navigate to Azure Portal -> Virtual Machine -> Extensions + applications.
    • Select AADLoginForWindows or AADSSHLoginForLinux extension.
    • Click Uninstall to disable Entra-based login authentication.

  3. Restrict RDP/SSH Access via Network Security Group

    • Navigate to Azure Portal -> Virtual Machine -> Networking -> Network settings.
    • Under Inbound port rules, find any rules allowing port 3389 (RDP) or 22 (SSH).
    • Click the rule -> modify Source to restrict to specific IPs or remove the rule entirely.

  4. Enable Just-in-Time VM Access

    • Navigate to Azure Portal -> Microsoft Defender for Cloud -> Workload protections.
    • Click Just-in-time VM access.
    • Select the VM -> click Enable JIT on VM.
    • Configure allowed ports, source IPs, and time windows.

  5. Deploy Azure Bastion (Recommended)

    • Navigate to Azure Portal -> Virtual Machine -> Connect.
    • Select Bastion -> click Deploy Bastion if not already configured.
    • Once deployed, connect via Bastion to avoid exposing RDP/SSH publicly.

Detection

Use the Azure Portal and Microsoft Entra admin center:

  1. In Azure Portal, open the target Virtual Machine.
  2. Open Activity log and filter Operation for login or loginAsAdmin.
  3. Review Microsoft.Compute/virtualMachines/login/action and Microsoft.Compute/virtualMachines/loginAsAdmin/action events.
  4. Open Microsoft Entra ID -> Sign-in logs and filter Application for Azure Linux VM Sign-In or Azure Windows VM Sign-In.
  5. Review User, IP address, Location, Date, and Status for unexpected VM admin logins.
  6. On the VM blade, open Monitoring -> Metrics and review Network In and Network Out during the same timeframe.

References

Was this page helpful?

Thank you for your feedback.