How to access Azure Linux virtual machines with Azure Active Directory
Tags: azure, linux
Published: 2019-04-04 19:41:58

---
title: How to access Azure Linux virtual machines with Azure Active Directory
published: True
tags: Azure, Linux
canonical_url: https://techcommunity.microsoft.com/t5/ITOps-Talk-Blog/How-to-access-Azure-Linux-virtual-machines-with-Azure-Active/ba-p/386824
---

Written By [@nepeters](https://twitter.com/nepeters)

Using Azure AD credentials for accessing Azure Linux Virtual Machines improves security by:

 

- Centrally controlling and enforcing access policies on Azure AD credentials
- Reducing the reliance on local access accounts
- Integration with multi-factor authentication

 

In this blog post, I will quickly walk through the basic configuration steps for accessing Azure Linux virtual machines using Azure AD credentials. For detailed steps and documentation, see [Log into a Linux Virtual machine in Azure using Azure Active Directory authentication](https://docs.microsoft.com/en-us/azure/virtual-machines/linux/login-using-aad?WT.mc_id=ITOpsTalk-blog-nepeters).

##  

## Create a Virtual Machine

 

First things first, you need an Azure Linux virtual machine. This blog uses the Azure CLI to create the virtual machine however any method for deploying virtual machine will work. If you already have an Azure Linux virtual machine, this section can be skipped.

 

Create a resource group using the [az group create](https://docs.microsoft.com/en-us/cli/azure/group?WT.mc_id=ITOpsTalk-blog-nepeters&view=azure-cli-latest#az-group-create) command.

 

```
az group create --name myResourceGroup --location eastus

```

 

Create a virtual machine using the [az vm create](https://docs.microsoft.com/cli/azure/vm?WT.mc_id=ITOpsTalk-blog-nepeters&view=azure-cli-latest#az-vm-create) command. Notice here that I have neither used the `--admin-username` argument to create a local user account nor used any arguments to create or provide SSH keys.

 

```
az vm create --resource-group myResourceGroup --name linuxVM --image UbuntuLTS

```

 

Here is where the magic happens. Use the [az vm extension set](https://docs.microsoft.com/cli/azure/vm/extension?WT.mc_id=ITOpsTalk-blog-nepeters&view=azure-cli-latest#az-vm-extension-set) command to install the Active Directory Linux SSH extension. This extension is responsible for the configuration of the Azure AD integration.

 

```
az vm extension set --publisher Microsoft.Azure.ActiveDirectory.LinuxSSH --name AADLoginForLinux --resource-group myResourceGroup --vm-name linuxVM

```

##  

## Configure Role-Based Access

 

Before logging into the virtual machine with an Azure AD account, the Azure AD access must be configured. To do so, we will create a role binding between the Azure AD account, the "Virtual Machines Administrators Login" AD role, and the virtual machine.

 

First, get the ID of the virtual machine using the [az vm show](https://docs.microsoft.com/cli/azure/vm?WT.mc_id=ITOpsTalk-blog-nepeters&view=azure-cli-latest#az-vm-show) command. In this example, the ID is stored in a variables name **VMID**.

 

```
VMID=$(az vm show --resource-group myResourceGroup --name linuxVM --query id -o tsv)

```

 

Create the role binding using the [az role assignment create](https://docs.microsoft.com/en-us/cli/azure/role/assignment?WT.mc_id=ITOpsTalk-blog-nepeters&view=azure-cli-latest#az-role-assignment-create) command. Notice here that the **--assignee** would be the Azure AD account or group for which the access is established.

 

```
az role assignment create --role "Virtual Machine Administrator Login" --assignee user@contoso.com --scope $VMID

```

##  

## Access the VM

 

With the VM created, and the access established, you can now access the VM using SSH. First, get the public IP address of the virtual machine. This can be done with the [az](https://docs.microsoft.com/cli/azure/vm?WT.mc_id=ITOpsTalk-blog-nepeters&view=azure-cli-latest#az-vm-show)vm[ show](https://docs.microsoft.com/cli/azure/vm?WT.mc_id=ITOpsTalk-blog-nepeters&view=azure-cli-latest#az-vm-show) command.

 

```
az vm show -d --resource-group myResourceGroup --name linuxVM --query publicIps -o tsv

```

 

Now create the SSH connection. In this example, I am using SSH from a terminal. Take note that the Azure AD user account is specified in the command.

 

```
ssh user@contoso.com @137.117.88.113

```

 

Once completed, you are prompted to open up a browser and complete the authentication. Follow the instructions and press ENTER when done.

 

```
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code AJ9GDRXBQ to authenticate. Press ENTER when ready.

```

 

At this point, the SSH connection should have been successfully created. Feel free to reach out in comments or on Twitter at [@nepeters](https://twitter.com/nepeters).