Require Azure AD Login on Linux VM

Question

I followed setup guide from MS document: https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-linux

Everything works except one thing, if I do ssh from different client (Azure requires CLI for AAD login) I can still log in to the Linux servers with a local account. The document above says: "Use Azure deploy and audit policies to require Azure AD login for Linux VMs and flag non-approved local accounts" but I am totally getting the runaround about how to REQUIRE logins be only through AAD credentials. I've had a support ticket open for 6 weeks and have gone through 4 different support groups with no success.

I need this for SOC2 compliance and given that Azure has documentation that their services are SOC2 compliant, I cant imagine this is not achievable. Does anyone know how to force Linux servers to only permit ADD credentials for login?

Answer 1

To force Linux servers to only permit ADD credentials for login, try the below mentioned solution to be implemented in your Azure subscription:

Kindly deploy the below Azure policy definitions with the resource group as the scope to disallow local login for Linux VM:

Go to Azure portal -> Search Azure policy -> Definition -> Select the appropriate scope -> select the definition type as policy -> select the category as guest configuration -> select the below policies

• Linux machines should only have local accounts that are allowed

Assign the policy to the required scope and ensure to mention/do not mention the required local accounts in Linux VM for that scope under the parameters tab.

• Authentication to Linux machine should require SSH keys

Assign the policy to the required scope and ensure to select the effect 'Auditifnotexists' under the parameters tab.

Note :

Ensure to uncheck the option for 'Only show parameters that need input or review'. So that you will be able to mention the allowed local accounts in parameters.

For more in detail, please refer below link:

Built-in policy definitions for Azure Virtual Machines - Azure Virtual Machines | Microsoft Docs.