Install SSH access

Connect P0 to your Azure VMs by installing SSH access.

This final step connects P0's SSH integration to your Azure subscription enabling SSH access requests to Virtual Machines.

Complete Configure bastion host integration before starting this step. SSH access requires the Bastion host configuration from the previous step.

How SSH subscription filtering works

When you configure SSH access, P0 only shows Azure subscriptions that already have a Bastion host configured. If your subscription does not appear in the list, verify that the Bastion host component is installed for that subscription.

Virtual machine requirements

Any virtual machine you want to connect to via SSH through P0 must meet the following requirements.

Requirement	Details
AADSSHLoginForLinux extension	Must be installed on each Linux VM. VMs without this extension do not appear in the P0 inventory. See Microsoft documentation for installation instructions.
Network connectivity	VMs must be in a virtual network that is either: the same virtual network as the Bastion host, or a peered virtual network connected to the Bastion's virtual network.

Virtual network peering

P0 automatically manages virtual network (VNet) peering between the Bastion host's network and the target VM's network when they are in different virtual networks.

• Session start: If the Bastion host and the target VM are in different VNets, P0 creates bidirectional VNet peering between them. If they share the same VNet, no peering is needed.

• Session end: When an SSH session ends, P0 removes the VNet peering — but only if no other active SSH sessions depend on that same peering.

This ensures that VNet peering exists only while SSH sessions are active, and that concurrent sessions sharing the same peering are not disrupted.

Permissions

Microsoft Graph API permission

During setup, P0 grants the User.Read.All Microsoft Graph API permission to the Azure app registration created in Step 1. P0 uses this permission to look up the requesting user's identity in your Entra ID directory when initiating an SSH session.

Permission	Type	Purpose
User.Read.All	Application	Read user profiles in your Entra ID directory

This is a read-only permission — P0 cannot modify user profiles.

A separate Entra ID directory integration is not required for Azure SSH. The User.Read.All permission on the app registration is sufficient for P0 to resolve user identities during SSH sessions.

Custom Azure role

During setup, P0 creates a custom Azure role scoped to the target subscription. This role grants P0 the permissions needed to manage VM access and VNet peering during SSH sessions.

Role name: P0 Virtual Machine Management - {subscriptionId}

Required permissions:

Permission	Purpose
Microsoft.Compute/virtualMachines/read	Read VM metadata
Microsoft.Compute/virtualMachines/extensions/read	Check for required VM extensions
Microsoft.Network/networkInterfaces/read	Read VM network interface details
Microsoft.Network/publicIPAddresses/read	Read VM public IP address details
Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read	Read existing VNet peering
Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write	Create VNet peering for SSH sessions
Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete	Remove VNet peering after sessions end
Microsoft.Network/virtualNetworks/peer/action	Authorize VNet peering operations
Microsoft.Network/bastionHosts/getactivesessions/action	Query active Bastion sessions

The role also grants the Microsoft.Compute/virtualMachines/login/action data action so users can sign in to VMs.

If you enable sudo access, P0 creates a separate custom role named P0 Virtual Machine Admin Management - {subscriptionId}. This role has the same actions as the role described earlier, plus both the Microsoft.Compute/virtualMachines/login/action and Microsoft.Compute/virtualMachines/loginAsAdmin/action data actions, which allow administrative (sudo) sign-in.

Setup steps

1. In P0, open Integrations → SSH.

1. Click Add account.

1. Select the Azure subscription you added during IAM management setup. Only subscriptions with a Bastion host configured appear in this list.

1. Run the install commands displayed in the P0 UI. The install steps include:

   • Microsoft Graph API permissions: Grant User.Read.All to the P0 app registration's service principal via the Microsoft Graph API.

   • Subscription targeting: Set the Azure CLI to the target subscription.

   • Custom role creation: Create the P0 Virtual Machine Management role with the required permissions.

   • Role assignment: Assign the custom role to the P0 service principal.

Optional settings

• Grouping tag: specify a tag to enable group SSH access requests

• Allow sudo: toggle whether users can request sudo on target nodes

If you enable sudo, run the additional Shell steps shown to configure sudo access.

When these steps are complete, SSH access is installed. You can now request SSH access to Azure VMs through P0.

Existing customers: If you previously configured Azure SSH with the Entra ID directory integration installed, you do not need to rerun the SSH install steps. The Entra directory integration already grants the User.Read.All permission to the same app registration.