1. Login into https://portal.azure.com
2. Navigate to the Azure Virtual Machine tab and go to the VM that is giving this error
3. Now under operations, select the Run Command option which will give you the option to run a PowerShell script
4. 
5. In the PowerShell script section, type in the below two lines and click on run

REG ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters\ /v AllowEncryptionOracle /t REG_DWORD /d 2

Set-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters' -name "AllowEncryptionOracle" 2 -Type DWord

1. On the client that has the CredSSP update installed, run gpedit.msc, and then browse to Computer Configuration > Administrative Templates > System > Credentials Delegation in the navigation pane.
2. Change the Encryption Oracle Remediation policy to Enabled, and then change Protection Level to Vulnerable.

1. Configure your Virtual Machine's WinRM listener to listen to HTTPS requests
2. Open the firewall port for the incoming traffic
3. Add a Network Security Group Rule to allow inbound requests into the Virtual Machine
4. Get the public IP Address of the Virtual Machine and remote into it

1. Connect-AzureARMVM (PowerShell Workflow) which performs steps 1,2,3 and 4 that were listed above
2. Remote-AzureARMVM (PowerShell Workflow) which uses the IP Address passed from Connect-AzureARMVM to remote into the VM and perform any operation
3. Connect-AzureARMVMPS (PowerShell Script) which performs steps 1,2,3 and 4 that were listed above
4. Remote-AzureARMVMPS (PowerShell Script) which uses the IP Address passed from Connect-AzureARMVM to remote into the VM and perform any operation

• ARM Virtual Machine that has a standard storage account.
  1. The two attached scripts can be used as is in this scenario.
  2. The script uses Custom Script Extension to configure the WinRM Listener, enable the firewall rule in the VM and stores this configuration script in a Script container in the storage account where the VM is hosted so that the Custom Script Extension can pick it up from there.
• ARM Virtual Machine that has a premium storage account.
  1. To configure such Virtual Machines, we will have to perform the steps 1,2,3 and 4 manually by running the following code block in a powershell prompt on the VM

#POWERSHELL TO EXECUTE ON REMOTE SERVER BEGINS HERE  
$DNSName = $env:COMPUTERNAME 
#Ensure PS remoting is enabled, although this is enabled by default for Azure VMs 
Enable-PSRemoting -Force   
#Create rule in Windows Firewall 
New-NetFirewallRule -Name "WinRM HTTPS" -DisplayName "WinRM HTTPS" -Enabled True -Profile "Any" -Action "Allow" -Direction "Inbound" -LocalPort 5986 -Protocol "TCP"    
#Create Self Signed certificate and store thumbprint 
$thumbprint = (New-SelfSignedCertificate -DnsName $DNSName -CertStoreLocation Cert:\LocalMachine\My).Thumbprint   
#Run WinRM configuration on command line. DNS name set to computer hostname, you may wish to use a FQDN 
$cmd = "winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname=""$DNSName""; CertificateThumbprint=""$thumbprint""}" 
cmd.exe /C $cmd   
#POWERSHELL TO EXECUTE ON REMOTE SERVER ENDS HERE

• Add a Network Security Group Rule for the VM on port 5986

• You can then fetch the Public IP Address of the VM and remote into it in the same way as described earlier.

$IpAddress = .\Connect-AzureARMVMPS.ps1 -AzureSubscriptionId $AzureSubscriptionId -AzureOrgIdCredentialName $AzureOrgIdCredentialName -ResourceGroupName $ResourceGroupName -VMName $VMName   
    Write-Output "The IP Address is $IpAddress. Attempting to remote into the VM.." 
    if($IpAddress -ne $null) 
    { 
           
            $sessionOptions = New-PSSessionOption -SkipCACheck -SkipCNCheck                 
            Invoke-Command -ComputerName $IpAddress -Credential $VMCredential -UseSSL -SessionOption $sessionOptions -ScriptBlock {  
            #Code to be executed in the remote session goes here 
            $hostname = hostname 
            Write-Output "Hostname : $hostname" 
            } 
 
    }

Username and Password OR Client ID and Client Secret Authentication

Certificate Authentication

public static async Task<string> GetToken(string authority, string resource, string scope)
{
 
    var authContext = new Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext(authority);
    ClientCredential clientCred = new ClientCredential(ConfigurationManager.AppSettings["ClientId"],
    ConfigurationManager.AppSettings["ClientSecret"]);
    AuthenticationResult result = await authContext.AcquireTokenAsync(resource, clientCred);
 
    if (result == null)
        throw new InvalidOperationException("Failed to obtain the JWT token");
 
    return result.AccessToken;
 
}
 
private static IEnumerable<SecretItem> FetchKeyVaultSecrets(string vaultName)
{
 
    try
    {
 
        keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(GetToken));
        var secrets = keyVaultClient.GetSecretsAsync("https://" + vaultName + ".vault.azure.net:443").Result.Value;
        return secrets;
 
    }
    catch (Exception ex)
    {
 
        return null;
 
    }
 
}
 
private static async void ConnectToServices()
{
 
    var secrets = FetchKeyVaultSecrets("RohitMinni"); //Fetch Secrets from the Vault
    var certificate = await FetchKeyVaultCredential(secrets, "certificate") as X509Certificate2; //Gets the uploaded certificate from the vault with password if any
    var subscriptionId = await FetchKeyVaultCredential(secrets, "subscriptionid") as string;
    var cloudServices = await GetCloudService(subscriptionId, certificate);
 
    /*
 
    var o365Username = await FetchKeyVaultCredential(secrets, "o365username") as string;
    var o365Password = await FetchKeyVaultCredential(secrets, "o365password") as string;
 
    You can write custom code here to authenticate using this username and password
 
    */
 
}
 
public async static Task<List<string>> GetCloudService(string subscriptionId, X509Certificate2 certificate)
{
 
    HostedServiceListResponse response;
    List<string> cloudServices;
    try
    {
 
        Microsoft.WindowsAzure.SubscriptionCloudCredentials credential = new Microsoft.WindowsAzure.CertificateCloudCredentials(subscriptionId, certificate);
        using (var computeClient = new ComputeManagementClient(credential))
        {
 
            response = await computeClient.HostedServices.ListAsync();
            cloudServices = response.HostedServices.Select(s => s.ServiceName).ToList();
 
        }
        return cloudServices;
 
    }
    catch (Exception ex)
    {
 
        return null;
 
    }
 
}

 private static async Task<Object> FetchKeyVaultCredential(IEnumerable<SecretItem> secrets, string secretType)
 {
 try
 {
 Secret localSecret = null;
 var secretId = secrets.Where(a => a.Identifier.Name.Contains(secretType)).FirstOrDefault();
 string certificatePassword = "";
 if (secretType == "certificate")
 {
 localSecret = await keyVaultClient.GetSecretAsync(secretId.Identifier.Identifier);
 var Password = localSecret.Value;

 //Extract associated certificate password if any
 var secretPasswordId = secrets.Where(a => a.Identifier.Name.Contains("certificatepassword")).FirstOrDefault();
 if(secretPasswordId != null)
 {
 localSecret = await keyVaultClient.GetSecretAsync(secretPasswordId.Identifier.Identifier); 
 certificatePassword = localSecret.Value;
 }
 var certificate = new X509Certificate2(Convert.FromBase64String(Password), certificatePassword, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.PersistKeySet | X509KeyStorageFlags.Exportable);
 return certificate;
 }
 else if(secretType == "subscriptionid")
 {
 localSecret = await keyVaultClient.GetSecretAsync(secretId.Identifier.Identifier);
 var Password = localSecret.Value;
 return Password;
 }
 else if (secretType == "subscriptionname")
 {
 localSecret = await keyVaultClient.GetSecretAsync(secretId.Identifier.Identifier);
 var Password = localSecret.Value;
 return Password;
 }
 }
 catch(Exception ex)
 {
 return null;
 }
 return null;
 }

public class KeyVaultDecryptor
    {
        private string vaultAddress;
        private string clientId;
        private string clientSecret;
 
        public KeyVaultDecryptor(string vaultAddress, string clientId, string clientSecret)
        {
            this.vaultAddress = vaultAddress;
            this.clientId = clientId;
            this.clientSecret = clientSecret;
        }
        public string DecryptText(string textToDecrypt)
        {
            var kv = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(GetToken));
            try
            {
                var key = kv.GetKeyAsync(vaultAddress, "NewKey", null).GetAwaiter().GetResult();
                
                var publicKey = Convert.ToBase64String(key.Key.N);
                using (var rsa = new RSACryptoServiceProvider())
                {
                    var p = new RSAParameters() { Modulus = key.Key.N, Exponent = key.Key.E };
                    rsa.ImportParameters(p);
 
                    // Decrypt
                    var encryptedTextNew = Convert.FromBase64String(textToDecrypt);
                    var decryptedData = kv.DecryptDataAsync(key.Key, JsonWebKeyEncryptionAlgorithm.RSAOAEP, encryptedTextNew).GetAwaiter().GetResult();
                    var decryptedText = Encoding.Unicode.GetString(decryptedData.Result);
 
                    return decryptedText;
                }
            }
            catch (Exception ex)
            {
                return "";
            }
        }
 
        public string EncryptText(string textToEncrypt)
        {
            var kv = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(GetToken));
            try
            {
                var key = kv.GetKeyAsync(vaultAddress, "NewKey", null).GetAwaiter().GetResult();
                
                var publicKey = Convert.ToBase64String(key.Key.N);
                using (var rsa = new RSACryptoServiceProvider())
                {
                    var p = new RSAParameters() { Modulus = key.Key.N, Exponent = key.Key.E };
                    rsa.ImportParameters(p);
                    var byteData = Encoding.Unicode.GetBytes(textToEncrypt);
 
                    // Encrypt
                    var encryptedText = rsa.Encrypt(byteData, true);
                    string encText = Convert.ToBase64String(encryptedText);
                    return encText;
                }
            }
            catch (Exception ex)
            {
                return "";
            }
        }
 
        async Task<string> GetToken(string authorization, string resource, string scope)
        {
            var authContext = new AuthenticationContext(authorization);
                     ClientCredential clientCred = new ClientCredential(clientId,clientSecret);
            AuthenticationResult result = await authContext.AcquireTokenAsync(resource, clientCred);
 
            if (result == null)
                throw new InvalidOperationException("Failed to obtain the JWT token");
 
            return result.AccessToken;
        }
    }