Securing remote shell access to virtual machines (VMs) in Azure protects network resources and data. Three key technologies—PowerShell remoting, PowerShell Direct, and Secure Shell (SSH)—provide different ways to connect to Windows and Linux VMs. Each method has specific security and access considerations that administrators must manage to keep the environment safe.
A comparison matrix branching out the three remote VM access methods: PowerShell Remoting, PowerShell Direct, and SSH, detailing their target OS, transport mechanism, and security requirements.
PowerShell Remoting uses the Windows Remote Management (WinRM) service to create authenticated and encrypted connections between devices. Administrators can run PowerShell commands on remote Windows systems, which simplifies managing multiple servers from one place. PowerShell Direct executes commands inside a VM directly from the Hyper‑V host, bypassing network layers entirely. This makes PowerShell Direct useful when a VM has no network connectivity or during network troubleshooting, because it does not rely on WinRM or network security rules.
For Linux VMs, SSH provides encrypted, secure shell access. Before using SSH, ensure the az extension add --name ssh command is run in the Azure CLI if the extension is not installed. Additional security comes from enforcing Conditional Access policies that require multifactor authentication, device compliance checks, and risk assessment before allowing SSH connections. These policies are applied through the Azure Linux VM Sign-In application in the Azure portal, so only authenticated and compliant devices can reach the VM.
Using the Azure CLI, sign in with az login (which opens a browser for Microsoft Entra credentials) and then connect with az ssh vm -n myVM -g AzureADLinuxVM. The Azure Cloud Shell works the same way: start Cloud Shell from the portal, run az login, and then use the same az ssh vm command. For automated scenarios, a service principal can authenticate: assign rights with az role assignment create so that automation scripts or tools can connect securely without a user’s interactive sign‑in.
Firewall rules and network security groups must allow SSH ports (usually TCP 22) only from trusted sources. Regularly review and update these rules to reduce the attack surface. Combining these network controls with the authentication and policy measures described above gives administrators a layered approach to secure remote shell access in hybrid environments.
Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Prepare and test your skills
Prepare and test your skills
PowerShell Remoting uses the Windows Remote Management (WinRM) service to create authenticated and encrypted connections between devices over the network. PowerShell Direct executes commands inside a VM directly from the Hyper-V host, bypassing network layers entirely.
PowerShell Direct is useful when a VM has no network connectivity or during network troubleshooting, because it does not rely on WinRM or network security rules.
First sign in with `az login` to authenticate using Microsoft Entra credentials, then connect with `az ssh vm -n myVM -g AzureADLinuxVM`.
Conditional Access policies can require multifactor authentication, device compliance checks, and risk assessment before allowing SSH connections. These policies are applied through the Azure Linux VM Sign-In application in the Azure portal.
StudyCerts
StudyCerts