> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable vm active directory authentication remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Enable Virtual Machine Access using Active Directory Authentication" in Azure using the Azure console, follow the below steps:

        1. Login to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).
        2. Navigate to the Virtual Machine for which you want to enable Active Directory authentication.
        3. Click on the "Networking" tab in the left-hand menu.
        4. Scroll down to the "Inbound port rules" section and click on "Add inbound port rule".
        5. In the "Add inbound security rule" window, provide the following details:
           * Name: Enter a name for the rule.
           * Priority: Enter a priority value for the rule. This value should be lower than any other existing rules.
           * Source: Select "Any" or specify the IP address range from where the traffic should be allowed.
           * Service: Select "RDP" or "SSH" depending on the protocol you want to enable.
           * Destination port ranges: Enter the port number for RDP or SSH.
           * Action: Select "Allow".
           * Protocol: Select "TCP".
           * Virtual machine: Select the virtual machine for which you want to enable Active Directory authentication.
           * NIC: Select the network interface card associated with the virtual machine.
           * Authentication type: Select "Azure Active Directory".
        6. Click on "Add" to create the inbound security rule.

        Once the above steps are completed, you have successfully enabled Virtual Machine Access using Active Directory Authentication for the selected Virtual Machine in Azure.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Enable Virtual Machine Access using Active Directory Authentication" in AZURE using AZURE CLI, follow the below steps:

        Step 1: Login to AZURE CLI by running the command `az login`.

        Step 2: Run the command `az vm update` to update the virtual machine.

        Step 3: Add the `--authentication-type all` parameter to the command.

        Step 4: Add the `--admin-username <username>` and `--admin-password <password>` parameters to specify the admin username and password.

        Step 5: Add the `--set osProfile.windowsConfiguration.enableAutomaticUpdates=true` parameter to enable automatic updates.

        Step 6: Add the `--set osProfile.windowsConfiguration.provisionVMAgent=true` parameter to provision the virtual machine agent.

        Step 7: Add the `--set osProfile.windowsConfiguration.winRM.listeners.protocol=https` parameter to enable HTTPS protocol for WinRM listeners.

        Step 8: Add the `--set osProfile.windowsConfiguration.winRM.listeners.certificateUrl=<certificate-url>` parameter to specify the certificate URL for WinRM listeners.

        Step 9: Add the `--set osProfile.windowsConfiguration.winRM.listeners.certificateThumbprint=<certificate-thumbprint>` parameter to specify the certificate thumbprint for WinRM listeners.

        Step 10: Add the `--set osProfile.windowsConfiguration.winRM.listeners.allowedOrigins=<allowed-origins>` parameter to specify the allowed origins for WinRM listeners.

        Step 11: Finally, run the command `az vm update` with all the parameters mentioned above to remediate the misconfiguration "Enable Virtual Machine Access using Active Directory Authentication" in AZURE using AZURE CLI.

        Note: Replace `<username>`, `<password>`, `<certificate-url>`, `<certificate-thumbprint>`, and `<allowed-origins>` with the actual values.
      </Accordion>

      <Accordion title="Using Python">
        To enable Virtual Machine Access using Active Directory Authentication in Azure using Python, you can follow the below steps:

        1. Install the Azure SDK for Python using the following command:

           ```
           pip install azure
           ```

        2. Import the required libraries:

           ```
           from azure.mgmt.compute import ComputeManagementClient
           from azure.common.credentials import ServicePrincipalCredentials
           ```

        3. Authenticate with Azure Active Directory using a Service Principal:

           ```
           credentials = ServicePrincipalCredentials(
               client_id='<client_id>',
               secret='<client_secret>',
               tenant='<tenant_id>'
           )
           ```

        4. Instantiate the ComputeManagementClient:

           ```
           compute_client = ComputeManagementClient(
               credentials,
               '<subscription_id>'
           )
           ```

        5. Get the Virtual Machine you want to enable AD Authentication for:

           ```
           vm = compute_client.virtual_machines.get(
               '<resource_group_name>',
               '<vm_name>'
           )
           ```

        6. Update the Virtual Machine's OS Profile to enable AD Authentication:

           ```
           vm.os_profile.windows_configuration.additional_unattend_content = [{
               "passName": "Microsoft-Windows-Shell-Setup",
               "componentName": "OOBE",
               "settingName": "AutoLogon",
               "content": '<AutoLogon><Enabled>true</Enabled><Username>{0}</Username><Password><Value>{1}</Value><PlainText>true</PlainText></Password></AutoLogon>'.format(
                   '<domain_username>',
                   '<domain_password>'
               )
           }]
           ```

           Replace `<domain_username>` and `<domain_password>` with the Active Directory username and password you want to use for authentication.

        7. Update the Virtual Machine in Azure:

           ```
           compute_client.virtual_machines.create_or_update(
               '<resource_group_name>',
               '<vm_name>',
               vm
           )
           ```

           This will update the Virtual Machine's OS Profile and enable AD Authentication.

        Note: Make sure that the Virtual Machine is joined to the domain and the Active Directory user has the necessary permissions to log in to the Virtual Machine.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Replace PLACEHOLDERS with your own values:
        # - RESOURCE_GROUP_NAME: existing resource group name
        # - LOCATION: Azure region (e.g., "eastus")
        # - VM_NAME: existing VM name
        # - SUBNET_ID: existing subnet ID
        # - ADMIN_USERNAME: existing admin username

        # Example: Linux VM with Azure AD-based SSH login
        resource "azurerm_linux_virtual_machine" "example" {
          name                = "VM_NAME"
          resource_group_name = "RESOURCE_GROUP_NAME"
          location            = "LOCATION"
          size                = "Standard_DS1_v2"

          network_interface_ids = [
            azurerm_network_interface.example.id,
          ]

          admin_username = "ADMIN_USERNAME"

          # IMPORTANT: enabling a managed identity on an existing VM
          # (changing identity.type from "None" to "SystemAssigned" or "UserAssigned")
          # FORCES REPLACEMENT of the VM resource.
          identity {
            type = "SystemAssigned"
          }

          os_disk {
            name                 = "VM_NAME-osdisk"
            caching              = "ReadWrite"
            storage_account_type = "Standard_LRS"
          }

          source_image_reference {
            publisher = "Canonical"
            offer     = "0001-com-ubuntu-server-focal"
            sku       = "20_04-lts"
            version   = "latest"
          }
        }

        resource "azurerm_network_interface" "example" {
          name                = "VM_NAME-nic"
          resource_group_name = "RESOURCE_GROUP_NAME"
          location            = "LOCATION"

          ip_configuration {
            name                          = "internal"
            subnet_id                     = "SUBNET_ID"
            private_ip_address_allocation = "Dynamic"
          }
        }

        # Azure AD login extension for Linux (SSH via AAD)
        resource "azurerm_virtual_machine_extension" "aad_ssh_login" {
          name                 = "AADSSHLoginForLinux"
          virtual_machine_id   = azurerm_linux_virtual_machine.example.id
          publisher            = "Microsoft.Azure.ActiveDirectory"
          type                 = "AADSSHLoginForLinux"
          type_handler_version = "1.0"

          settings = jsonencode({})
        }

        # Example: Windows VM with Azure AD-based RDP login
        resource "azurerm_windows_virtual_machine" "win_example" {
          name                = "WIN_VM_NAME"
          resource_group_name = "RESOURCE_GROUP_NAME"
          location            = "LOCATION"
          size                = "Standard_DS1_v2"

          network_interface_ids = [
            azurerm_network_interface.win_example.id,
          ]

          admin_username = "ADMIN_USERNAME"

          # Enabling managed identity may FORCE REPLACEMENT, same as for Linux.
          identity {
            type = "SystemAssigned"
          }

          os_disk {
            name                 = "WIN_VM_NAME-osdisk"
            caching              = "ReadWrite"
            storage_account_type = "Standard_LRS"
          }

          source_image_reference {
            publisher = "MicrosoftWindowsServer"
            offer     = "WindowsServer"
            sku       = "2019-Datacenter"
            version   = "latest"
          }
        }

        resource "azurerm_network_interface" "win_example" {
          name                = "WIN_VM_NAME-nic"
          resource_group_name = "RESOURCE_GROUP_NAME"
          location            = "LOCATION"

          ip_configuration {
            name                          = "internal"
            subnet_id                     = "SUBNET_ID"
            private_ip_address_allocation = "Dynamic"
          }
        }

        # Azure AD login extension for Windows (RDP via AAD)
        resource "azurerm_virtual_machine_extension" "aad_login_windows" {
          name                 = "AADLoginForWindows"
          virtual_machine_id   = azurerm_windows_virtual_machine.win_example.id
          publisher            = "Microsoft.Azure.ActiveDirectory"
          type                 = "AADLoginForWindows"
          type_handler_version = "1.0"

          settings = jsonencode({})
        }
        ```

        `terraform plan` should show the creation of `azurerm_virtual_machine_extension.aad_ssh_login` (and/or `aad_login_windows`) and, if you are adding an identity to an existing VM, a replacement of the corresponding `azurerm_linux_virtual_machine` / `azurerm_windows_virtual_machine` resource due to `identity.type` changing from `None` to `SystemAssigned`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>