> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/integrations/resource-integrations/microsoft-azure/jump-host-management.md). # Jump host management {% hint style="info" %} Jump host management is in **beta**. {% endhint %} Configure the jump host management component to let P0 send privileged commands, such as terminating a live SSH session, to jump host VMs in your Azure tenant. P0 sends these commands through a [**connector**](/readme/connectors.md): an Azure Function App that runs P0's connector image. P0 authenticates to the connector using [workload identity federation](https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation), so no secrets are stored. The connector runs commands on your jump host VMs using a least-privilege custom role scoped to those VMs only. {% hint style="warning" %} Complete [IAM management](/integrations/resource-integrations/microsoft-azure/iam-management.md) before starting this step. Jump host management requires the service identity created during [Azure app registration](/integrations/resource-integrations/microsoft-azure/azure-app-registration.md). {% endhint %} ## Prerequisites * You have completed [Azure app registration](/integrations/resource-integrations/microsoft-azure/azure-app-registration.md) and [IAM management](/integrations/resource-integrations/microsoft-azure/iam-management.md) on your tenant. * You can create app registrations, custom roles, and role assignments in the target subscription. The [Owner](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/privileged#owner) role grants these permissions. * You have the resource IDs of the jump host VMs that P0 manages. * Install [Terraform](https://developer.hashicorp.com/terraform/install) 1.5 or later if you use the Terraform install path. ## How it works The install creates the following resources in a dedicated connector resource group: | Resource | Purpose | | ------------------------------------------ | ----------------------------------------------------------------------------------- | | App registration (`p0-session-terminator`) | The identity P0 authenticates as, using workload identity federation. | | Federated credential | Trusts P0's Google service account so P0 can obtain Azure tokens without secrets. | | Function App | Runs P0's connector image and dispatches commands to your jump hosts. | | Custom role (`P0 Session Terminator`) | Grants the connector the minimum permissions to run commands on your jump host VMs. | The Function App is protected so that only P0's app registration can call it. Requests from any other caller return a `401` response. ## Permissions The install creates a custom role scoped to your jump host VMs and assigns it to the connector Function App's managed identity. **Role name:** `P0 Session Terminator` **Required permissions:** | Permission | Purpose | | ----------------------------------------------------- | --------------------------------------------------- | | `Microsoft.Compute/virtualMachines/read` | Read jump host VM configuration and status. | | `Microsoft.Compute/virtualMachines/runCommand/action` | Run commands on jump host VMs. | | `Microsoft.Compute/virtualMachines/runCommands/write` | Manage the run commands used to terminate sessions. | ## Setup steps 1. In the **Azure** integration on [p0.app](https://p0.app), select **Jump host management**. To understand what the install creates — the app registration, the Function App, and the role P0 uses — see [The jump host connector application](/integrations/resource-integrations/microsoft-azure/jump-host-management/jump-host-connector-application.md). 2. Run the install commands displayed in the P0 UI. Choose either the **Shell** or **Terraform** path. The install steps: * **Subscription targeting:** Set the Azure CLI to the connector subscription and set your tenant ID. * **Connector infrastructure:** Create the connector resource group, storage account, and App Service plan. * **App registration:** Create the session terminator app registration and its federated credential. * **Connector deployment:** Deploy the connector Function App and enable app registration authentication. * **Custom role:** Create the `P0 Session Terminator` role and assign it to the connector, scoped to your jump host VMs. Replace the following placeholders with your values: | Placeholder | Value | | ---------------------------- | ---------------------------------------------------------------- | | `` | Your Azure tenant (Entra directory) ID. | | `` | The subscription that hosts the connector. | | `` | The management group that contains your jump host subscriptions. | | `` | The resource ID of each jump host VM. | 3. Enter the connector details in P0: | Field | Description | How to find it | | ---------------------------- | ------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Application client ID** | The app registration P0 uses to authenticate to the connector. Must be a UUID. | Terraform output `jump_host_management_client_id`, or run `az ad app list --display-name "p0-session-terminator" --query "[0].appId" -o tsv`. | | **Function app resource ID** | The Azure resource ID of the connector Function App. | Terraform output `jump_host_management_function_app_resource_id`, or run `az functionapp list --resource-group p0-security-jump-host-connector-rg --query "[0].id" -o tsv`. | The Function App resource ID follows this format: `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{functionAppName}` Jump host management is now configured. P0 can send privileged commands to the jump host VMs covered by the `P0 Session Terminator` role assignment. ## Manage with the P0 Terraform provider Instead of entering the connector details in the dashboard, you can register jump host management with P0 as code using the [`p0_azure_jump_host`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/azure_jump_host) resource in the [P0 Terraform provider](https://registry.terraform.io/providers/p0-security/p0/latest). This is the recommended path for teams that manage their P0 configuration declaratively. {% hint style="info" %} The `p0_azure_jump_host` resource requires P0 Terraform provider [v0.42.0](https://github.com/p0-security/terraform-provider-p0/releases/tag/v0.42.0) or later. {% endhint %} The provider registers the component with P0 given the connector's `client_id` and `function_app_resource_id`. You still deploy the connector infrastructure — the app registration, federated credential, and Function App — using the Terraform path in [Setup steps](#setup-steps). Feed those resources' outputs into `p0_azure_jump_host`. 1. **Install the Terraform CLI** if you haven't already. See the [Terraform installation guide](https://developer.hashicorp.com/terraform/install). 2. **Generate a P0 API token.** The P0 provider authenticates with an API token that you create in the P0 dashboard — see [Generating an API key](/p0-management/generating-an-api-key.md). Export it so the provider can read it: ```bash export P0_API_TOKEN= ``` 3. **Register jump host management.** Declare the P0 provider, the base Azure resources, and the `p0_azure_jump_host` resource: ```terraform terraform { required_providers { p0 = { source = "p0-security/p0" version = ">= 0.42.0" } } } provider "p0" { org = "your-p0-organization" } resource "p0_azure" "example" { directory_id = "" } resource "p0_azure_app" "example" { depends_on = [p0_azure.example] client_id = "" } # Registers jump host management: P0 authenticates as the app registration # (via workload identity federation) and dispatches privileged commands to your # jump hosts through the Azure Function App identified below. resource "p0_azure_jump_host" "example" { depends_on = [ p0_azure.example, p0_azure_app.example, ] client_id = "" function_app_resource_id = "/subscriptions//resourceGroups//providers/Microsoft.Web/sites/" } ``` 4. **Apply the configuration:** ```bash terraform init terraform apply ``` For the full argument reference, see the [`p0_azure_jump_host` resource documentation](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/azure_jump_host). ## Troubleshooting | Error | Cause | Resolution | | ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | | "Application client ID is required." | The client ID field is empty. | Enter the app registration client ID from the install output. | | "Expected application client ID (UUID format)." | The client ID is not a valid UUID. | Enter the `appId` value, not the app registration name or object ID. | | "Enter a valid Function App resource ID." | The Function App resource ID is malformed. | Enter the full resource ID, including the `/subscriptions/.../providers/Microsoft.Web/sites/...` path. | | Requests to the connector return `401` | The caller is not P0's app registration, or the client ID entered in P0 does not match the deployed app registration. | Confirm the **Application client ID** matches the app registration created during install. | ## Related pages * [Configure bastion host integration](/integrations/resource-integrations/microsoft-azure/configure-bastion-host-integration.md) * [Install SSH access](/integrations/resource-integrations/microsoft-azure/install-ssh-access.md)