Share via

What is Windows SSH Posture Control (private preview) with Azure Policy and PowerShell?

SSH Posture Control enables you to use the familiar workflows of Azure Policy and Machine Configuration to:

  • Ensure compliance with standards in your industry or organization
  • Reduce attack surface of remote management features
  • Ensure consistent setup across your fleet for security and productivity

SSH Posture Control also provides detailed Reasons describing how compliance or non-compliance was determined. These Reasons make it easier to take action or to fully document compliance.

Screenshot showing list of compliant SSH checks

SSH Posture Control analyzes and enforces approximately 20 SSH server (sshd) parameters. You can also customize certain parameters to suit your environment. For example, you can customize which users and groups are allowed SSH access as well as the port number and more.

You can deploy SSH Posture Control in either audit, or audit-and-configure mode to audit your fleet of devices, track results, then automatically remediate the fleet to proper sshd standards.

Private preview limitations

Important

SSH Posture Control is in private preview-- intended to trigger dialog between you and Microsoft.

  • The preview is intended for use with isolated dev/test machines where any problem (including inadvertently locking yourself out from SSH access) would not have important consequences.
  • The preview involves importing the policy definition, rather than choosing it from the Azure Policy built-in list.
  • For this we will be providing both the audit, and audit-and-configure workflow.
  • Supported Windows SKUs are currently only Windows Server 2025

Getting started with Azure Policy

This example is focused on getting started quickly within Azure Policy. It makes simplifying assumptions and does not explore everything that is possible. For example, it uses default SSH settings from the PolicyDefinition, rather than customizing parameters such as allowed users and groups. More comprehensive information on SSH Posture Control including settings and behaviors is expected in the near future. Note that the PowerShell section is in the section towards the end of the article.

Tip

The following mental model and terminology are used throughout this article.

Diagram showing that our Azure subscription will contain a PolicyDefinition which is linked through a PolicyAssignment to a ResourceGroup containing machines

  • PolicyDefinition : SSH Posture Control definition and metadata, as represented in the Azure Policy service.
  • PolicyAssignment : Links your SSH Posture Control PolicyDefinition to a scope where that policy should be applied, such as a resource group.
  • Machine : An endpoint capable of being managed by Azure Policy and Machine Configuration (aka Guest Configuration). In other words, an Arc enabled machine or an Azure VM.

A. Pre-requisites

  1. An Azure account with permission to create a resource group, a VM (or Arc machine), a policy definition and a policy assignment.
  2. For additional pre-requisites, choose your preferred experience:
  1. Using a web browser, sign in to Azure Portal or your local equivalent.

B. Create a resource group

  1. Create a resource group. In upcoming steps this will be used to scope the policy, and to contain a new test machine.

screen capture of creating a resource group

C. Create the PolicyDefinition

Note

This extra step (creating rather than just choosing the PolicyDefinition) is required during the private preview.

  1. Navigate to the Azure Policy Overview page. For example, you could use the URI: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Overview.
  2. Navigate to the Definitions view.
  3. Click the + Policy Definition button to create a new PolicyDefinition, entering the following as inputs.
    1. Definition location: Choose your Azure subscription where the PolicyDefinition will live.
    2. Name: [Preview] Audit SSH Posture Control policy or [Preview] Configure SSH Posture Control policy
    3. Category: Use Existing, then choose Guest Configuration
    4. Policy rule: Delete the pre-existing JSON, and paste the PolicyDefinition JSON from Preview audit SSH Posture Control policy definition or Preview audit-and-configure SSH Posture Control policy definition
  4. Click Save

Screen capture illustrating the preceding steps

D. Use a PolicyAssignment to apply the PolicyDefinition to your resource group

Caution

This policy modifies sshd configuration on in-scope machines. These instructions have you assigning it to an initially empty resource group, where you will later create a test machine. Take great care if you choose to assign to any broader scope.

  1. Navigate to the Policy | Definitions page which lists all available policy definitions.
  2. Select the [Preview] SSH Posture Control policy PolicyDefinition you created earlier
  3. Click Assign.
  4. For Scope choose the resource group where you will later create a new test machine.
  5. Proceed to the Parameters tab.
    1. Choose "true" for Include Arc connected machines, unless you specifically want to exclude Arc connected machines.
    2. NOTE: If you want to customize SSH settings, such as allowed groups, uncheck the Only show parameters... box to reveal all of the available parameters. If you do choose to specify allowed or denied users or groups, please be aware that you would enter a space delimited string, for example userA userB.
  6. Proceed to the Remediation tab.
    1. NOTE: Although this demo focuses on a new machine, in other scenarios where you want the PolicyAssignment to apply to existing machines you can check the box for Create a remediation task.
    2. Choose Create a Managed Identity with System assigned and an identity location of your choice.
  7. Proceed to Review + create
    1. Choose Create to complete the PolicyAssignment.

Screen capture showing an example of the preceding PolicyAssignment steps

E. Create a new machine

Although new PolicyAssignments can apply to existing machines, the process can take up to a 24 hours. For this quick-start we will focus on evaluating a new machine. In this example we will create an Azure VM, but you could create an Arc enabled machine if you prefer.

  1. Navigate to the Azure Virtual Machines experience.
  2. Create a new VM, ensuring the following properties:
    1. Subscription and Resource Group should match where the PolicyAssignment was scoped.
    2. Image should be "Windows Server 2025".
    3. VM architecture should be x64.
    4. Other properties such as VM name, size, etc. can be whatever you prefer.
  3. Wait for the VM creation to complete, and then click Go to Resource to reach the machine overview page
  4. In the left-hand navigation, select Identity and ensure that the machine has a system managed identity
  5. In the left-hand navigation, select Extensions + applications, then + Add
  6. Choose the Azure Machine Configuration extension for Windows extension and select Next
  7. Select Review + create, then create

Screen capture showing an example of the preceding steps

F. Take a break before proceeding

When new PolicyDefinitions, PolicyAssignments, and machines are involved, it can take several minutes for everything to reach steady-state. Consider waiting at least 30 minutes before proceeding to the next step.

G. Observe compliance results

The following steps enable you to see a compliance rollup at different altitudes:

  • Compliance by PolicyAssignment
    • Number of machines compliant and non-compliant
    • Highest altitude, especially useful for large fleets
  • Compliance by machine
    • List of machines with yes/no per machine
  • Compliance by setting, for a specific machine
    • Deepest level of detail, like the screenshot at the top of this article.

Tip

Your new machine will likely be judged as non-compliant when it encounters the policy for the first time. The default SSH settings in the policy are more strict than what many OS images have configured by default. After an additional 20 minutes or so, you should find that your machine becomes compliant thanks to the remediation logic built-in to SSH Posture Control.

  1. Navigate to the Policy | Compliance page.
  2. Select [Preview] SSH Posture Control policy.
  3. Observe that the number of compliant / non-compliant machines is reported
  4. Under Resource Compliance you can see the status for individual machines
  5. To drill down to the setting-by-setting details for a specific machine:
    1. Click the ... next to a machine, and choose View resource to reach the machine's Overview page
    2. In the left hand navigation under Operations, click Configuration management (not Configuration under Settings)
    3. Click SecureShell
    4. The resulting page shows each setting in the configuration with details about compliance as well as how compliance was determined.

Screen capture showing preceding steps

Getting started with the Local Experience (PowerShell)

Prerequisites

To apply a baseline, verify that the baseline is applied, remove a baseline, or view detailed compliance information for OSConfig in PowerShell, use the commands on the following tabs.

Configure

To apply the SSH scenario, run the following command:

Set-OSConfigDesiredConfiguration -Scenario SSH -Default

Verify

To verify that the SSH scenario is properly applied, run the following command:

Get-OSConfigDesiredConfiguration -Scenario SSH

Check compliance

To obtain the desired configuration details for the specified scenario, use the following commands. The output appears in a table format that includes the name of the configuration item, its compliance status, and the reason for noncompliance.

To check the compliance details for SSH scenairo, run the following command:

Get-OSConfigDesiredConfiguration -Scenario SSH | ft Name, @{ Name = "Status"; Expression={$_.Compliance.Status} }, @{ Name = "Reason"; Expression={$_.Compliance.Reason} } -AutoSize -Wrap

Custom Configuration

To custom the setting in SSH scenario, you can configure a setting with parameter '-Name' and '-Value':

Set-OSConfigDesiredConfiguration -Scenario SSH -Name Banner -Value "Custom Banner"

Next step

Contact the team at Microsoft to provide feedback, features requests, etc.

Contact Us

  • Last updated on