Custom jump host

Connect P0 to your Azure VMs through your own virtual machine acting as a jump host.

When you select the Custom jump host connection type, P0 connects through a virtual machine that acts as a jump host, instead of a managed Azure Bastion host. You provide the jump host VM's Azure resource ID. P0 validates the resource ID and resolves the public IP address on the VM's primary NIC at install time, then uses that IP to reach the jump host for SSH sessions.

This page is one of two connection types for bastion host configuration. For an overview and the shared subscription steps, start on the Configure bastion host integration page.

Prerequisites

You must have a virtual machine that P0 can use as a jump host. The VM must meet the following requirements.

Requirement	Details
Public IP address	The VM must have a public IP address on its primary network interface (NIC). P0 resolves this IP at install time and uses it to reach the jump host.
Azure AD login for Linux extension	The VM must have the Azure AD login for Linux extension (AADSSHLoginForLinux) installed. P0 authenticates SSH sessions through Azure IAM, so the jump host must support this plugin.
SSH server	The VM must have an SSH server (sshd) installed and running so it can serve as a jump host for SSH sessions.
Resource ID	You must have the VM's Azure resource ID, in the format /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupId}/providers/Microsoft.Compute/virtualMachines/{vmName}.

A custom jump host does not use a P0-created role. Instead, your connecting users must hold an Azure role that grants the jump host permissions needed to reach VMs through the jump host over Azure IAM.

Permissions

P0 doesn't create a role for the custom jump host connection type. Instead, you grant a role to the users who connect to VMs through the jump host, so they can reach those VMs over Azure IAM. Point the Role Definition ID field at a built-in role, an existing custom role, or a new custom role that you create.

At minimum, the role must include these permissions:

{
  "actions": [
    "Microsoft.Network/publicIPAddresses/read",
    "Microsoft.Network/virtualNetworks/read",
    "Microsoft.Network/loadBalancers/read",
    "Microsoft.Network/networkInterfaces/read",
    "Microsoft.Compute/virtualMachines/*/read"
  ],
  "notActions": [],
  "dataActions": [
    "Microsoft.Compute/virtualMachines/login/action"
  ],
  "notDataActions": []
}

The Microsoft.Compute/virtualMachines/login/action data action lets the user sign in to the VM through the Azure AD login for Linux extension. The read actions let the connecting user resolve the jump host and target VM network configuration.

Setup steps

Complete the shared subscription steps first, then select Custom jump host as the connection type and continue with the following steps.

1. Enter the Virtual machine resource ID of the jump host VM. P0 validates the resource ID format and confirms the VM has a public IP address on its primary NIC.

   The virtual machine resource ID follows this format:

   /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupId}/providers/Microsoft.Compute/virtualMachines/{vmName}

2. Enter the Role Definition ID of the role your connecting users hold to reach VMs through the jump host over Azure IAM. This can be a built-in role, an existing custom role, or a new custom role. See Permissions for the minimum permissions it must include.

   P0 does not create this role, so no role setup commands run for this connection type.

The Bastion host configuration is now complete.

Manage with the P0 Terraform provider

Instead of entering the jump host details in the dashboard, you can register the custom jump host connection with P0 as code using the p0_azure_bastion_host resource in the P0 Terraform provider. To connect through a custom jump host, configure the resource's jump_host block. This is the recommended path for teams that manage their P0 configuration declaratively.

The jump_host mode of the p0_azure_bastion_host resource requires P0 Terraform provider v0.45.0 or later.

In jump_host mode, the resource registers your existing jump host VM with P0 — no staged resource or Azure Bastion host is needed. The VM must have a public IP address on its primary network interface, which P0 resolves and stores at install time. You still create the role your connecting users hold in Azure and pass its role definition ID to the resource.

1. Install the Terraform CLI if you haven't already. See the Terraform installation guide.

2. Generate a P0 API token. The P0 provider authenticates with an API token that you create in the P0 dashboard — see Generating an API key. Export it so the provider can read it:

export P0_API_TOKEN=<your-p0-api-token>

1. Register the custom jump host. Declare the P0 provider, the base Azure resources, and the p0_azure_bastion_host resource with a jump_host block:

terraform {
  required_providers {
    p0 = {
      source  = "p0-security/p0"
      version = ">= 0.45.0"
    }
  }
}

provider "p0" {
  org = "your-p0-organization"
}

resource "p0_azure" "example" {
  directory_id = "<tenant-id>"
}

resource "p0_azure_app" "example" {
  depends_on = [p0_azure.example]
  client_id  = "<app-registration-client-id>"
}

resource "p0_azure_iam_write" "example" {
  depends_on      = [p0_azure_app.example]
  subscription_id = "<subscription-id>"
}

# Registers the custom jump host: P0 reaches your Azure VMs through this jump
# host VM, resolving the VM's public IP at install time. role_definition_id is
# the role your connecting users hold to reach VMs over Azure IAM.
resource "p0_azure_bastion_host" "example" {
  depends_on = [p0_azure_iam_write.example]

  subscription_id = "<subscription-id>"
  jump_host = {
    virtual_machine_id = "/subscriptions/<id>/resourceGroups/<rg>/providers/Microsoft.Compute/virtualMachines/<name>"
    role_definition_id = "/subscriptions/<id>/providers/Microsoft.Authorization/roleDefinitions/<guid>"
  }
}

1. Apply the configuration:

terraform init
terraform apply

To let P0 terminate active jump host sessions when access is revoked, also install the jump host management component, which the provider exposes as the p0_azure_jump_host resource.

For the full argument reference, see the p0_azure_bastion_host resource documentation.

Troubleshooting

Error	Cause	Resolution
"Enter a valid virtual machine resource ID"	The custom jump host resource ID is malformed	Enter the full VM resource ID, in the format /subscriptions/.../providers/Microsoft.Compute/virtualMachines/...
"The jump host virtual machine must have a public IP address on its primary NIC"	The jump host VM has no public IP on its primary NIC	Assign a public IP to the VM's primary network interface, then retry

Next step

Proceed to Install SSH access control to connect P0 to your Azure VMs.