> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_vm_admin_login.md).

# AZ\_VM\_ADMIN\_LOGIN

## Summary

|                            |                                                                                                                            |
| -------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| **Forestall ACL Alias**    | AZ\_VM\_ADMIN\_LOGIN                                                                                                       |
| **Azure Alias**            | Virtual Machine Administrator Login (Azure RBAC)                                                                           |
| **Affected Object Types**  | Virtual Machines                                                                                                           |
| **Exploitation Certainty** | Certain                                                                                                                    |
| **Azure RBAC Role**        | Virtual Machine Administrator Login (`1c0163c0-47e6-4577-8991-ea5c82e286e4`) - login to a virtual machine as administrator |

> **Note:** This role requires the VM to have the Microsoft Entra login extension installed and a system-assigned managed identity. It grants interactive RDP/SSH login with local administrator privileges using Microsoft Entra credentials.

## Description

`AZ_VM_ADMIN_LOGIN` represents the Azure RBAC **Virtual Machine Administrator Login** role assignment. This data-plane role grants interactive login access to Azure VMs **as a local administrator** using Microsoft Entra ID credentials.

Prerequisites for this role to be effective:

* The VM must have the Microsoft Entra login extension installed (`AADLoginForWindows` for Windows VMs or `AADSSHLoginForLinux` for Linux VMs).
* The VM must have a **system-assigned managed identity** enabled.
* Network connectivity must allow RDP (3389) or SSH (22) access.

This is distinct from `AZ_EXECUTE_COMMAND` which uses the RunCommand API - `AZ_VM_ADMIN_LOGIN` provides direct interactive shell access.

## Identification

### PowerShell (Az Module)

```powershell
Connect-AzAccount

# List all Virtual Machine Administrator Login role assignments
Get-AzRoleAssignment -RoleDefinitionName "Virtual Machine Administrator Login" |
    Select-Object DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

# Check specific VM for admin login assignments
Get-AzRoleAssignment -Scope "/subscriptions/<SubId>/resourceGroups/<RGName>/providers/Microsoft.Compute/virtualMachines/<VMName>" |
    Where-Object { $_.RoleDefinitionName -eq "Virtual Machine Administrator Login" } |
    Select-Object DisplayName, RoleDefinitionName, ObjectType |
    Format-Table -AutoSize

# Verify the Microsoft Entra login extension is installed on a VM
Get-AzVMExtension -ResourceGroupName "<RGName>" -VMName "<VMName>" |
    Where-Object { $_.Name -match "AAD" } |
    Select-Object Name, Publisher, ExtensionType |
    Format-Table -AutoSize
```

### Azure Portal

1. Open **Azure Portal** -> navigate to the target **Virtual Machine**.
2. Go to **Access control (IAM)** -> **Role assignments**.
3. Filter by **Role = Virtual Machine Administrator Login**.
4. Review all principals listed.
5. Verify the Microsoft Entra login extension under **Extensions + applications**.

## Exploitation

For detailed exploitation steps, refer to the following edges based on the target VM type:

* **Windows VMs:** See [AZ\_RDP](https://docs.forestall.io/fsprotect/edges/azure/az_rdp) for RDP exploitation with Entra ID credentials.
* **Linux VMs:** See [AZ\_SSH](https://docs.forestall.io/fsprotect/edges/azure/az_ssh) for SSH exploitation with Entra ID credentials.

## Mitigation

1. **Review and Remove Login Role Assignments**
   * Navigate to **Azure Portal** -> **Virtual Machine** -> **Access control (IAM)**.
   * Click **Role assignments** tab.
   * Filter by role: **Virtual Machine Administrator Login**.
   * Select unnecessary assignments -> click **Remove**.
2. **Remove Microsoft Entra login extension**
   * Navigate to **Azure Portal** -> **Virtual Machine** -> **Extensions + applications**.
   * Select **AADLoginForWindows** or **AADSSHLoginForLinux** extension.
   * Click **Uninstall** to disable Entra-based login authentication.
3. **Restrict RDP/SSH Access via Network Security Group**
   * Navigate to **Azure Portal** -> **Virtual Machine** -> **Networking** -> **Network settings**.
   * Under **Inbound port rules**, find any rules allowing port **3389** (RDP) or **22** (SSH).
   * Click the rule -> modify **Source** to restrict to specific IPs or remove the rule entirely.
4. **Enable Just-in-Time VM Access**
   * Navigate to **Azure Portal** -> **Microsoft Defender for Cloud** -> **Workload protections**.
   * Click **Just-in-time VM access**.
   * Select the VM -> click **Enable JIT on VM**.
   * Configure allowed ports, source IPs, and time windows.
5. **Deploy Azure Bastion (Recommended)**
   * Navigate to **Azure Portal** -> **Virtual Machine** -> **Connect**.
   * Select **Bastion** -> click **Deploy Bastion** if not already configured.
   * Once deployed, connect via Bastion to avoid exposing RDP/SSH publicly.

## Detection

Use the Azure Portal and Microsoft Entra admin center:

1. In **Azure Portal**, open the target **Virtual Machine**.
2. Open **Activity log** and filter **Operation** for `login` or `loginAsAdmin`.
3. Review `Microsoft.Compute/virtualMachines/login/action` and `Microsoft.Compute/virtualMachines/loginAsAdmin/action` events.
4. Open **Microsoft Entra ID** -> **Sign-in logs** and filter **Application** for **Azure Linux VM Sign-In** or **Azure Windows VM Sign-In**.
5. Review **User**, **IP address**, **Location**, **Date**, and **Status** for unexpected VM admin logins.
6. On the VM blade, open **Monitoring** -> **Metrics** and review **Network In** and **Network Out** during the same timeframe.

## References

* <https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-administrator-login>
* <https://learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-windows>
* <https://learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-linux>
* <https://blog.netspi.com/abusing-azure-ad-single-sign-on-for-ec2-access/>