Jump host management

Configure the jump host management connector so P0 can send privileged commands, such as terminating a live SSH session, to your Azure jump hosts.

Jump host management is in beta.

Configure the jump host management component to let P0 send privileged commands, such as terminating a live SSH session, to jump host VMs in your Azure tenant.

P0 sends these commands through a connector: an Azure Function App that runs P0's connector image. P0 authenticates to the connector using workload identity federation, so no secrets are stored. The connector runs commands on your jump host VMs using a least-privilege custom role scoped to those VMs only.

Complete IAM management before starting this step. Jump host management requires the service identity created during Azure app registration.

Prerequisites

• You have completed Azure app registration and IAM management on your tenant.

• You can create app registrations, custom roles, and role assignments in the target subscription. The Owner role grants these permissions.

• You have the resource IDs of the jump host VMs that P0 manages.

• Install Terraform 1.5 or later if you use the Terraform install path.

How it works

The install creates the following resources in a dedicated connector resource group:

Resource	Purpose
App registration (p0-session-terminator)	The identity P0 authenticates as, using workload identity federation.
Federated credential	Trusts P0's Google service account so P0 can obtain Azure tokens without secrets.
Function App	Runs P0's connector image and dispatches commands to your jump hosts.
Custom role (P0 Session Terminator)	Grants the connector the minimum permissions to run commands on your jump host VMs.

The Function App is protected so that only P0's app registration can call it. Requests from any other caller return a 401 response.

Permissions

The install creates a custom role scoped to your jump host VMs and assigns it to the connector Function App's managed identity.

Role name: P0 Session Terminator

Required permissions:

Permission	Purpose
Microsoft.Compute/virtualMachines/read	Read jump host VM configuration and status.
Microsoft.Compute/virtualMachines/runCommand/action	Run commands on jump host VMs.
Microsoft.Compute/virtualMachines/runCommands/write	Manage the run commands used to terminate sessions.

Setup steps

1. In the Azure integration on p0.app, select Jump host management.

   To understand what the install creates — the app registration, the Function App, and the role P0 uses — see The jump host connector application.

2. Run the install commands displayed in the P0 UI. Choose either the Shell or Terraform path. The install steps:

   • Subscription targeting: Set the Azure CLI to the connector subscription and set your tenant ID.

   • Connector infrastructure: Create the connector resource group, storage account, and App Service plan.

   • App registration: Create the session terminator app registration and its federated credential.

   • Connector deployment: Deploy the connector Function App and enable app registration authentication.

   • Custom role: Create the P0 Session Terminator role and assign it to the connector, scoped to your jump host VMs.

   Replace the following placeholders with your values:

   Placeholder	Value
   <tenant-id>	Your Azure tenant (Entra directory) ID.
   <subscription-id>	The subscription that hosts the connector.
   <management-group-id>	The management group that contains your jump host subscriptions.
   <jump-host-vm-resource-id>	The resource ID of each jump host VM.

3. Enter the connector details in P0:

   Field	Description	How to find it
   Application client ID	The app registration P0 uses to authenticate to the connector. Must be a UUID.	Terraform output jump_host_management_client_id, or run az ad app list --display-name "p0-session-terminator" --query "[0].appId" -o tsv.
   Function app resource ID	The Azure resource ID of the connector Function App.	Terraform output jump_host_management_function_app_resource_id, or run az functionapp list --resource-group p0-security-jump-host-connector-rg --query "[0].id" -o tsv.

   The Function App resource ID follows this format:

   /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{functionAppName}

Jump host management is now configured. P0 can send privileged commands to the jump host VMs covered by the P0 Session Terminator role assignment.

Manage with the P0 Terraform provider

Instead of entering the connector details in the dashboard, you can register jump host management with P0 as code using the p0_azure_jump_host resource in the P0 Terraform provider. This is the recommended path for teams that manage their P0 configuration declaratively.

The p0_azure_jump_host resource requires P0 Terraform provider v0.42.0 or later.

The provider registers the component with P0 given the connector's client_id and function_app_resource_id. You still deploy the connector infrastructure — the app registration, federated credential, and Function App — using the Terraform path in Setup steps. Feed those resources' outputs into p0_azure_jump_host.

1. Install the Terraform CLI if you haven't already. See the Terraform installation guide.

2. Generate a P0 API token. The P0 provider authenticates with an API token that you create in the P0 dashboard — see Generating an API key. Export it so the provider can read it:

export P0_API_TOKEN=<your-p0-api-token>

1. Register jump host management. Declare the P0 provider, the base Azure resources, and the p0_azure_jump_host resource:

terraform {
  required_providers {
    p0 = {
      source  = "p0-security/p0"
      version = ">= 0.42.0"
    }
  }
}

provider "p0" {
  org = "your-p0-organization"
}

resource "p0_azure" "example" {
  directory_id = "<tenant-id>"
}

resource "p0_azure_app" "example" {
  depends_on = [p0_azure.example]
  client_id  = "<app-registration-client-id>"
}

# Registers jump host management: P0 authenticates as the app registration
# (via workload identity federation) and dispatches privileged commands to your
# jump hosts through the Azure Function App identified below.
resource "p0_azure_jump_host" "example" {
  depends_on = [
    p0_azure.example,
    p0_azure_app.example,
  ]

  client_id                = "<connector-app-registration-client-id>"
  function_app_resource_id = "/subscriptions/<id>/resourceGroups/<rg>/providers/Microsoft.Web/sites/<name>"
}

1. Apply the configuration:

terraform init
terraform apply

For the full argument reference, see the p0_azure_jump_host resource documentation.

Troubleshooting

Error	Cause	Resolution
"Application client ID is required."	The client ID field is empty.	Enter the app registration client ID from the install output.
"Expected application client ID (UUID format)."	The client ID is not a valid UUID.	Enter the appId value, not the app registration name or object ID.
"Enter a valid Function App resource ID."	The Function App resource ID is malformed.	Enter the full resource ID, including the /subscriptions/.../providers/Microsoft.Web/sites/... path.
Requests to the connector return 401	The caller is not P0's app registration, or the client ID entered in P0 does not match the deployed app registration.	Confirm the Application client ID matches the app registration created during install.

Related pages

• Configure bastion host integration

• Install SSH access