Azure-VirtualMachines-VM-Active-Directory-(AD)-Authentication-Enabled

Severity : High

Description: This control ensures that virtual machines uses Azure Active Directory for authentication. Azure Active Directory Domain Services provides managed domain services such as domain join, group policy, LDAP, Kerberos/NTLM authentication. Azure AD managed domain can provide domain join features and management to virtual machines (VMs) in Azure. Azure AD for virtual machines allows access policies management to allow or deny access, eliminate need for local administrator, enforce password policies and MFA for login, assign Role-Based access control policies.

Remediation Steps:

Perform following to Remove all non-required guest users :

Login to Azure Portal using https://portal.azure.com.
Navigate to Resources and filter Virtual Machines to select the virtual machine reported.
Select the virtual machine name reported.

Install AAD extension on the VM

Under Settings, Select Extensions + application.
Select Add button.
Select Azure Ad based Login extension, like Azure Ad based Windows Login or Azure Ad based Linux Login.
Select the Review + Create.
Select Click the Create.

Enable Managed Identity

Under Settings, Select Identity.
Select System assigned identity and Select the Status to On.

Assign a role for the VM

Navigate to Access Control (IAM).
Select Add, and Add role assignment.
Select roles Virtual Machine Administrator Login and Virtual Machine User Login.
On the Members, Select one or more of the Azure AD users, groups, or Service principal.
In the Select managed identities, select System-assigned managed Identity, and Select the VM’s ID enabled above.
Select Select.
Click Next.
Click Review + assign to assign the role.

Important:

Reference: