Bilješka
Pristup ovoj stranici zahtijeva provjeru vjerodostojnosti. Možete pokušati da se prijavite ili promijenite direktorije.
Pristup ovoj stranici zahtijeva provjeru vjerodostojnosti. Možete pokušati promijeniti direktorije.
Just-in-time (JIT) access gives users temporary SSH access to a small form factor device through Microsoft Entra Privileged Identity Management (PIM), using a short-lived certificate.
This article covers the one-time setup. After that, users connect by following Connect using JIT access.
Important
This feature is currently in PREVIEW. See the Supplemental Terms of Use for Microsoft Azure Previews for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
Note
The provisionedmachine Azure CLI extension is in preview. Preview features are provided without a service-level agreement and aren't recommended for production workloads.
Roles
| Role | Description |
|---|---|
| Azure administrator | The person doing the setup. |
| Provisioned Machine Admin | A PIM role on the resource. Gives a user SSH access with sudo. |
| Provisioned Machine Contributor | A PIM role on the resource. Gives a user SSH access without sudo. |
Prerequisites
Azure administrator:
- A small form factor resource in your subscription.
- Permission to manage PIM role assignments on that resource.
- Verify that you have Key Vault Crypto Officer on the key vault created during the provisioning flow.
- Azure CLI installed.
Step 1: Admin creates the Key Vault CA key
A Key Vault CA key is a signing key in Azure Key Vault that acts as the certificate authority for the device. The device trusts SSH certificates signed by this key, and the CLI calls the Key Vault Sign API to issue each user a short-lived certificate. The private key is non-exportable and never leaves Key Vault.
The key vault is created automatically during the provisioning flow, so it already exists.
- Navigate to the key vault created for your device, select Objects > Keys, and select New.
- Import the key that was created during the provisioning flow by uploading that file.
- Name this new key
<provisioned-machine-name>-ssh-ca— for example,machine1-ssh-ca. - The key vault should now have the original key pair that was there by default and the new ssh-ca key you imported.
Step 2: Admin grants eligible PIM assignments
An admin needs to set up PIM for their organization. For more information about PIM, see Privileged Identity Management documentation.
In Azure portal, open Microsoft Entra Privileged Identity Management > Azure resources.
Select the small form factor resource, and then select Assignments > Add assignments.
Users can be assigned to two eligible roles. Assign a provisioned machine role to the user:
- Provisioned Machine Admin if they need
sudo. - Provisioned Machine Contributor if they don't.
- Provisioned Machine Admin if they need
On the Settings tab, set the assignment type to Eligible, not Active.
Add an approver to approve the request.
Repeat on the resource's key vault, assigning Key Vault Crypto User as Eligible.
Step 3: Users install the CLI extension
The provisionedmachine Azure CLI extension provides the provisioned machine SSH command. Install it from the .whl package.
Download the provisionedmachine extension .whl file.
Install the extension.
az extension add --source <path-to-provisionedmachine.whl>If the extension is already installed, remove it and reinstall it to ensure you have the correct version:
az extension remove --name provisionedmachine az extension add --source <path-to-provisionedmachine.whl>Confirm the extension is installed:
az extension list --output table