From 9a571694ce53bdbd2d59b5c5ce030a3e12321d35 Mon Sep 17 00:00:00 2001 From: Simon Vedder Date: Thu, 23 Jul 2026 17:49:43 +0200 Subject: [PATCH] Add policies to deploy the Microsoft Entra login extensions to Azure virtual machines --- .../azurepolicy.json | 161 +++++++++++++++ .../azurepolicy.parameters.json | 47 +++++ .../azurepolicy.rules.json | 101 ++++++++++ .../azurepolicy.json | 189 ++++++++++++++++++ .../azurepolicy.parameters.json | 27 +++ .../azurepolicy.rules.json | 149 ++++++++++++++ 6 files changed, 674 insertions(+) create mode 100644 policyDefinitions/Compute/configure-linux-virtual-machines-to-use-microsoft-entra-login/azurepolicy.json create mode 100644 policyDefinitions/Compute/configure-linux-virtual-machines-to-use-microsoft-entra-login/azurepolicy.parameters.json create mode 100644 policyDefinitions/Compute/configure-linux-virtual-machines-to-use-microsoft-entra-login/azurepolicy.rules.json create mode 100644 policyDefinitions/Compute/configure-windows-virtual-machines-to-use-microsoft-entra-login/azurepolicy.json create mode 100644 policyDefinitions/Compute/configure-windows-virtual-machines-to-use-microsoft-entra-login/azurepolicy.parameters.json create mode 100644 policyDefinitions/Compute/configure-windows-virtual-machines-to-use-microsoft-entra-login/azurepolicy.rules.json diff --git a/policyDefinitions/Compute/configure-linux-virtual-machines-to-use-microsoft-entra-login/azurepolicy.json b/policyDefinitions/Compute/configure-linux-virtual-machines-to-use-microsoft-entra-login/azurepolicy.json new file mode 100644 index 00000000..8520fac4 --- /dev/null +++ b/policyDefinitions/Compute/configure-linux-virtual-machines-to-use-microsoft-entra-login/azurepolicy.json @@ -0,0 +1,161 @@ +{ + "name": "5fc585fc-9c50-471f-b19e-013cd1bca813", + "type": "Microsoft.Authorization/policyDefinitions", + "properties": { + "displayName": "Configure Linux virtual machines to use Microsoft Entra login", + "description": "Deploys the AADSSHLoginForLinux extension to Linux virtual machines from a supported image publisher, so users can sign in over SSH with Microsoft Entra credentials and OpenSSH certificates. Only virtual machines that already have a system-assigned managed identity are targeted, because the extension fails with exit code 22 without one. Set matchAllLinuxImages to true for custom images. Machines need a running VM agent, 1 GB of memory and outbound HTTPS to packages.microsoft.com.", + "metadata": { + "category": "Compute", + "version": "1.0.0" + }, + "mode": "Indexed", + "parameters": { + "effect": { + "type": "String", + "metadata": { + "displayName": "Effect", + "description": "DeployIfNotExists, AuditIfNotExists or Disabled the execution of the Policy" + }, + "allowedValues": [ + "DeployIfNotExists", + "AuditIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists" + }, + "supportedImagePublishers": { + "type": "Array", + "metadata": { + "displayName": "Supported image publishers", + "description": "Marketplace image publishers whose distributions are supported by the AADSSHLoginForLinux extension. Virtual machines built from other publishers are not targeted unless matchAllLinuxImages is set to true." + }, + "defaultValue": [ + "Canonical", + "Debian", + "credativ", + "RedHat", + "SUSE", + "Oracle", + "almalinux", + "resf", + "MicrosoftCBLMariner", + "almalinuxosfoundation1628089859865", + "erockyenterprisesoftwarefoundationinc1653071250513" + ] + }, + "matchAllLinuxImages": { + "type": "Boolean", + "metadata": { + "displayName": "Match all Linux images", + "description": "Set to true to target every Linux virtual machine regardless of its image reference, for example when custom images are used. Set to false to only target the image publishers listed in supportedImagePublishers." + }, + "allowedValues": [ + true, + false + ], + "defaultValue": false + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Compute/virtualMachines" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType", + "equals": "Linux" + }, + { + "field": "identity.type", + "contains": "SystemAssigned" + }, + { + "anyOf": [ + { + "value": "[parameters('matchAllLinuxImages')]", + "equals": true + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.publisher", + "in": "[parameters('supportedImagePublishers')]" + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]", + "details": { + "type": "Microsoft.Compute/virtualMachines/extensions", + "evaluationDelay": "AfterProvisioningSuccess", + "existenceCondition": { + "allOf": [ + { + "field": "Microsoft.Compute/virtualMachines/extensions/publisher", + "equals": "Microsoft.Azure.ActiveDirectory" + }, + { + "field": "Microsoft.Compute/virtualMachines/extensions/type", + "equals": "AADSSHLoginForLinux" + }, + { + "field": "Microsoft.Compute/virtualMachines/extensions/provisioningState", + "equals": "Succeeded" + } + ] + }, + "roleDefinitionIds": [ + "/providers/Microsoft.Authorization/roleDefinitions/9980e02c-c2be-4d73-94e8-173b1dc7cf3c" + ], + "deployment": { + "properties": { + "mode": "incremental", + "template": { + "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "vmName": { + "type": "string" + }, + "location": { + "type": "string" + } + }, + "resources": [ + { + "name": "[concat(parameters('vmName'), '/AADSSHLoginForLinux')]", + "type": "Microsoft.Compute/virtualMachines/extensions", + "location": "[parameters('location')]", + "apiVersion": "2023-03-01", + "properties": { + "publisher": "Microsoft.Azure.ActiveDirectory", + "type": "AADSSHLoginForLinux", + "typeHandlerVersion": "1.0", + "autoUpgradeMinorVersion": true + } + } + ], + "outputs": { + "policy": { + "type": "string", + "value": "[concat('Enabled Microsoft Entra login for Linux VM', ': ', parameters('vmName'))]" + } + } + }, + "parameters": { + "vmName": { + "value": "[field('name')]" + }, + "location": { + "value": "[field('location')]" + } + } + } + } + } + } + } + } +} diff --git a/policyDefinitions/Compute/configure-linux-virtual-machines-to-use-microsoft-entra-login/azurepolicy.parameters.json b/policyDefinitions/Compute/configure-linux-virtual-machines-to-use-microsoft-entra-login/azurepolicy.parameters.json new file mode 100644 index 00000000..5149c282 --- /dev/null +++ b/policyDefinitions/Compute/configure-linux-virtual-machines-to-use-microsoft-entra-login/azurepolicy.parameters.json @@ -0,0 +1,47 @@ +{ + "effect": { + "type": "String", + "metadata": { + "displayName": "Effect", + "description": "DeployIfNotExists, AuditIfNotExists or Disabled the execution of the Policy" + }, + "allowedValues": [ + "DeployIfNotExists", + "AuditIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists" + }, + "supportedImagePublishers": { + "type": "Array", + "metadata": { + "displayName": "Supported image publishers", + "description": "Marketplace image publishers whose distributions are supported by the AADSSHLoginForLinux extension. Virtual machines built from other publishers are not targeted unless matchAllLinuxImages is set to true." + }, + "defaultValue": [ + "Canonical", + "Debian", + "credativ", + "RedHat", + "SUSE", + "Oracle", + "almalinux", + "resf", + "MicrosoftCBLMariner", + "almalinuxosfoundation1628089859865", + "erockyenterprisesoftwarefoundationinc1653071250513" + ] + }, + "matchAllLinuxImages": { + "type": "Boolean", + "metadata": { + "displayName": "Match all Linux images", + "description": "Set to true to target every Linux virtual machine regardless of its image reference, for example when custom images are used. Set to false to only target the image publishers listed in supportedImagePublishers." + }, + "allowedValues": [ + true, + false + ], + "defaultValue": false + } +} diff --git a/policyDefinitions/Compute/configure-linux-virtual-machines-to-use-microsoft-entra-login/azurepolicy.rules.json b/policyDefinitions/Compute/configure-linux-virtual-machines-to-use-microsoft-entra-login/azurepolicy.rules.json new file mode 100644 index 00000000..d52a6b0a --- /dev/null +++ b/policyDefinitions/Compute/configure-linux-virtual-machines-to-use-microsoft-entra-login/azurepolicy.rules.json @@ -0,0 +1,101 @@ +{ + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Compute/virtualMachines" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType", + "equals": "Linux" + }, + { + "field": "identity.type", + "contains": "SystemAssigned" + }, + { + "anyOf": [ + { + "value": "[parameters('matchAllLinuxImages')]", + "equals": true + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.publisher", + "in": "[parameters('supportedImagePublishers')]" + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]", + "details": { + "type": "Microsoft.Compute/virtualMachines/extensions", + "evaluationDelay": "AfterProvisioningSuccess", + "existenceCondition": { + "allOf": [ + { + "field": "Microsoft.Compute/virtualMachines/extensions/publisher", + "equals": "Microsoft.Azure.ActiveDirectory" + }, + { + "field": "Microsoft.Compute/virtualMachines/extensions/type", + "equals": "AADSSHLoginForLinux" + }, + { + "field": "Microsoft.Compute/virtualMachines/extensions/provisioningState", + "equals": "Succeeded" + } + ] + }, + "roleDefinitionIds": [ + "/providers/Microsoft.Authorization/roleDefinitions/9980e02c-c2be-4d73-94e8-173b1dc7cf3c" + ], + "deployment": { + "properties": { + "mode": "incremental", + "template": { + "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "vmName": { + "type": "string" + }, + "location": { + "type": "string" + } + }, + "resources": [ + { + "name": "[concat(parameters('vmName'), '/AADSSHLoginForLinux')]", + "type": "Microsoft.Compute/virtualMachines/extensions", + "location": "[parameters('location')]", + "apiVersion": "2023-03-01", + "properties": { + "publisher": "Microsoft.Azure.ActiveDirectory", + "type": "AADSSHLoginForLinux", + "typeHandlerVersion": "1.0", + "autoUpgradeMinorVersion": true + } + } + ], + "outputs": { + "policy": { + "type": "string", + "value": "[concat('Enabled Microsoft Entra login for Linux VM', ': ', parameters('vmName'))]" + } + } + }, + "parameters": { + "vmName": { + "value": "[field('name')]" + }, + "location": { + "value": "[field('location')]" + } + } + } + } + } + } +} diff --git a/policyDefinitions/Compute/configure-windows-virtual-machines-to-use-microsoft-entra-login/azurepolicy.json b/policyDefinitions/Compute/configure-windows-virtual-machines-to-use-microsoft-entra-login/azurepolicy.json new file mode 100644 index 00000000..84426278 --- /dev/null +++ b/policyDefinitions/Compute/configure-windows-virtual-machines-to-use-microsoft-entra-login/azurepolicy.json @@ -0,0 +1,189 @@ +{ + "name": "304dff40-5056-4cbb-986c-58dc7edc8ee3", + "type": "Microsoft.Authorization/policyDefinitions", + "properties": { + "displayName": "Configure Windows virtual machines to use Microsoft Entra login", + "description": "Deploys the AADLoginForWindows extension to Windows virtual machines running a supported image, so users can sign in over RDP with Microsoft Entra credentials. Only virtual machines that already have a system-assigned managed identity are targeted, because the extension cannot install without one. Set matchAllWindowsImages to true for custom or golden images. Installing the extension joins the virtual machine to Microsoft Entra ID, which prevents an Active Directory domain join.", + "metadata": { + "category": "Compute", + "version": "1.0.0" + }, + "mode": "Indexed", + "parameters": { + "effect": { + "type": "String", + "metadata": { + "displayName": "Effect", + "description": "DeployIfNotExists, AuditIfNotExists or Disabled the execution of the Policy" + }, + "allowedValues": [ + "DeployIfNotExists", + "AuditIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists" + }, + "matchAllWindowsImages": { + "type": "Boolean", + "metadata": { + "displayName": "Match all Windows images", + "description": "Set to true to target every Windows virtual machine regardless of its image reference, for example when custom or golden images are used. Set to false to only target the marketplace images that Microsoft documents as supported." + }, + "allowedValues": [ + true, + false + ], + "defaultValue": false + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Compute/virtualMachines" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType", + "equals": "Windows" + }, + { + "field": "identity.type", + "contains": "SystemAssigned" + }, + { + "anyOf": [ + { + "value": "[parameters('matchAllWindowsImages')]", + "equals": true + }, + { + "allOf": [ + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.publisher", + "equals": "MicrosoftWindowsServer" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.offer", + "equals": "WindowsServer" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku", + "notContains": "core" + }, + { + "anyOf": [ + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku", + "like": "2022-*" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku", + "like": "2025-*" + } + ] + } + ] + }, + { + "allOf": [ + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.publisher", + "equals": "MicrosoftWindowsDesktop" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku", + "like": "win11-*" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku", + "notLike": "win11-21h2*" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku", + "notLike": "win11-22h2*" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku", + "notLike": "win11-23h2*" + } + ] + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]", + "details": { + "type": "Microsoft.Compute/virtualMachines/extensions", + "evaluationDelay": "AfterProvisioningSuccess", + "existenceCondition": { + "allOf": [ + { + "field": "Microsoft.Compute/virtualMachines/extensions/publisher", + "equals": "Microsoft.Azure.ActiveDirectory" + }, + { + "field": "Microsoft.Compute/virtualMachines/extensions/type", + "equals": "AADLoginForWindows" + }, + { + "field": "Microsoft.Compute/virtualMachines/extensions/provisioningState", + "equals": "Succeeded" + } + ] + }, + "roleDefinitionIds": [ + "/providers/Microsoft.Authorization/roleDefinitions/9980e02c-c2be-4d73-94e8-173b1dc7cf3c" + ], + "deployment": { + "properties": { + "mode": "incremental", + "template": { + "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "vmName": { + "type": "string" + }, + "location": { + "type": "string" + } + }, + "resources": [ + { + "name": "[concat(parameters('vmName'), '/AADLoginForWindows')]", + "type": "Microsoft.Compute/virtualMachines/extensions", + "location": "[parameters('location')]", + "apiVersion": "2023-03-01", + "properties": { + "publisher": "Microsoft.Azure.ActiveDirectory", + "type": "AADLoginForWindows", + "typeHandlerVersion": "1.0", + "autoUpgradeMinorVersion": true + } + } + ], + "outputs": { + "policy": { + "type": "string", + "value": "[concat('Enabled Microsoft Entra login for Windows VM', ': ', parameters('vmName'))]" + } + } + }, + "parameters": { + "vmName": { + "value": "[field('name')]" + }, + "location": { + "value": "[field('location')]" + } + } + } + } + } + } + } + } +} diff --git a/policyDefinitions/Compute/configure-windows-virtual-machines-to-use-microsoft-entra-login/azurepolicy.parameters.json b/policyDefinitions/Compute/configure-windows-virtual-machines-to-use-microsoft-entra-login/azurepolicy.parameters.json new file mode 100644 index 00000000..2def8a14 --- /dev/null +++ b/policyDefinitions/Compute/configure-windows-virtual-machines-to-use-microsoft-entra-login/azurepolicy.parameters.json @@ -0,0 +1,27 @@ +{ + "effect": { + "type": "String", + "metadata": { + "displayName": "Effect", + "description": "DeployIfNotExists, AuditIfNotExists or Disabled the execution of the Policy" + }, + "allowedValues": [ + "DeployIfNotExists", + "AuditIfNotExists", + "Disabled" + ], + "defaultValue": "DeployIfNotExists" + }, + "matchAllWindowsImages": { + "type": "Boolean", + "metadata": { + "displayName": "Match all Windows images", + "description": "Set to true to target every Windows virtual machine regardless of its image reference, for example when custom or golden images are used. Set to false to only target the marketplace images that Microsoft documents as supported." + }, + "allowedValues": [ + true, + false + ], + "defaultValue": false + } +} diff --git a/policyDefinitions/Compute/configure-windows-virtual-machines-to-use-microsoft-entra-login/azurepolicy.rules.json b/policyDefinitions/Compute/configure-windows-virtual-machines-to-use-microsoft-entra-login/azurepolicy.rules.json new file mode 100644 index 00000000..548feca6 --- /dev/null +++ b/policyDefinitions/Compute/configure-windows-virtual-machines-to-use-microsoft-entra-login/azurepolicy.rules.json @@ -0,0 +1,149 @@ +{ + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.Compute/virtualMachines" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType", + "equals": "Windows" + }, + { + "field": "identity.type", + "contains": "SystemAssigned" + }, + { + "anyOf": [ + { + "value": "[parameters('matchAllWindowsImages')]", + "equals": true + }, + { + "allOf": [ + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.publisher", + "equals": "MicrosoftWindowsServer" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.offer", + "equals": "WindowsServer" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku", + "notContains": "core" + }, + { + "anyOf": [ + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku", + "like": "2022-*" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku", + "like": "2025-*" + } + ] + } + ] + }, + { + "allOf": [ + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.publisher", + "equals": "MicrosoftWindowsDesktop" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku", + "like": "win11-*" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku", + "notLike": "win11-21h2*" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku", + "notLike": "win11-22h2*" + }, + { + "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku", + "notLike": "win11-23h2*" + } + ] + } + ] + } + ] + }, + "then": { + "effect": "[parameters('effect')]", + "details": { + "type": "Microsoft.Compute/virtualMachines/extensions", + "evaluationDelay": "AfterProvisioningSuccess", + "existenceCondition": { + "allOf": [ + { + "field": "Microsoft.Compute/virtualMachines/extensions/publisher", + "equals": "Microsoft.Azure.ActiveDirectory" + }, + { + "field": "Microsoft.Compute/virtualMachines/extensions/type", + "equals": "AADLoginForWindows" + }, + { + "field": "Microsoft.Compute/virtualMachines/extensions/provisioningState", + "equals": "Succeeded" + } + ] + }, + "roleDefinitionIds": [ + "/providers/Microsoft.Authorization/roleDefinitions/9980e02c-c2be-4d73-94e8-173b1dc7cf3c" + ], + "deployment": { + "properties": { + "mode": "incremental", + "template": { + "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "vmName": { + "type": "string" + }, + "location": { + "type": "string" + } + }, + "resources": [ + { + "name": "[concat(parameters('vmName'), '/AADLoginForWindows')]", + "type": "Microsoft.Compute/virtualMachines/extensions", + "location": "[parameters('location')]", + "apiVersion": "2023-03-01", + "properties": { + "publisher": "Microsoft.Azure.ActiveDirectory", + "type": "AADLoginForWindows", + "typeHandlerVersion": "1.0", + "autoUpgradeMinorVersion": true + } + } + ], + "outputs": { + "policy": { + "type": "string", + "value": "[concat('Enabled Microsoft Entra login for Windows VM', ': ', parameters('vmName'))]" + } + } + }, + "parameters": { + "vmName": { + "value": "[field('name')]" + }, + "location": { + "value": "[field('location')]" + } + } + } + } + } + } +}