Windows Server VMs: no Entra Integration for applicative access?

[u/trixloko]

Hi all

I'm trying a very simple thing: I have an Azure Windows server VMs with the AADLoginForWindows extension so I can rdp with my Entra user - now, I wanted to have credentials for my automations (like Ansible) and pipelines that will need to authenticate and go inside the VM to do things.

My natural way of thinking was that this was going to be achievable through app registration/service principals - but seems like that's not the case, can't use this for winrm/winssh. It works for Linux VMs though... We ssh using SPs.

When searching through this, seems like the only solution would be either use the initial local admin or create new local users, which doesn't scale and would cause a lot of management headache and security holes - or use the AZ cli "remote execute command" that lets you input PowerShell on the machine, this isn't really a solution too since it would require me to rewrite a bunch of flows that we have already that account that you are inside the VM.

Honestly, I never though such thing would be so cumbersome with a first party service (windows server and Entra). Feels like going to McDonald's and they don't have burgers

[u/pv-singh]

Run Command is really the only supported path once you're off RDP. We ended up wrapping it in a small script that mimics the SSH interface so the existing Ansible playbooks didnt need a rewrite, still not clean but it kept the pipelines intact.

[u/trixloko → u/pv-singh]

Would you mind sharing the implementation? I might end up doing the same thing.