> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/integrations/resource-integrations/microsoft-azure/jump-host-management/jump-host-connector-application.md).

# The jump host connector application

The connector application is the Azure identity P0 uses to manage access to your jump hosts. It's the Azure implementation of a [P0 connector](/readme/connectors.md). It has two parts:

* An **app registration** (`p0-session-terminator`) that P0 authenticates as, using [workload identity federation](https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation) — no secrets are stored.
* A **Function App** that runs P0's [connector image](/integrations/resource-integrations/microsoft-azure/jump-host-management/jump-host-connector-image.md) and dispatches privileged commands, such as terminating a live SSH session, to your jump host VMs.

This page describes each part and the trust between them. To install the connector, follow the guided steps in the P0 dashboard — see [Jump host management](/integrations/resource-integrations/microsoft-azure/jump-host-management.md).

{% hint style="info" %}
Jump host management is in **beta**.
{% endhint %}

## The session terminator app registration

The `p0-session-terminator` app registration is the service identity P0 presents when it calls your connector. Instead of a client secret, the app registration carries a **federated credential** that trusts P0's Google service account. At runtime, P0 exchanges a Google Cloud service account token for an Entra access token scoped to this app registration. Because the credential is federated, no secret is ever created, stored, or rotated.

The app registration issues **v2.0** access tokens so they match the Function App's authentication configuration. Its App ID URI is `api://<client-id>`, and its federated credential trusts a single P0 service account as the subject — so no other identity can obtain a token for it.

## The connector Function App

The Function App runs P0's connector image and exposes the endpoint P0 calls to terminate a session. It has a **system-assigned managed identity**, which is the principal that receives the `P0 Session Terminator` role on each jump host VM.

The Function App is protected by **App Service Authentication**, configured so that only the `p0-session-terminator` app registration can call it:

* Requests carrying a valid token from the app registration are accepted.
* Every other caller — including unauthenticated requests — receives a `401` response.

This means the connector has no public, callable surface: P0's federated identity is the only caller Azure will admit.

## The session terminator role

P0 runs commands on your jump hosts through a least-privilege custom role. You define the role once and assign it only to individual jump host VMs, so the connector can act on the VMs you choose and nothing else.

**Role name:** `P0 Session Terminator`

**Assigned to:** the connector Function App's system-assigned managed identity, scoped to each jump host VM.

| Permission                                            | Purpose                                             |
| ----------------------------------------------------- | --------------------------------------------------- |
| `Microsoft.Compute/virtualMachines/read`              | Read jump host VM configuration and status.         |
| `Microsoft.Compute/virtualMachines/runCommand/action` | Run commands on jump host VMs.                      |
| `Microsoft.Compute/virtualMachines/runCommands/write` | Manage the run commands used to terminate sessions. |

Because the role is assigned per VM, adding a jump host to P0's management is a matter of assigning this role on that VM's scope.

## How the pieces work together

1. P0 exchanges its Google service account token for an Entra token scoped to the `p0-session-terminator` app registration.
2. P0 calls the connector Function App with that token. App Service Authentication admits the request only because it comes from the trusted app registration.
3. The connector uses its managed identity — which holds the `P0 Session Terminator` role on the target VM — to run the termination command on your jump host.

At no point does P0 hold a standing secret, and the connector can act only on the VMs you assign the role to.

## Register the connector with P0

After you install the connector, you enter two values in the jump host management component on [p0.app](https://p0.app):

| Field                        | Value                                                     |
| ---------------------------- | --------------------------------------------------------- |
| **Application client ID**    | The `p0-session-terminator` app registration's client ID. |
| **Function app resource ID** | The Azure resource ID of the connector Function App.      |

The Function App resource ID follows this format:

`/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{functionAppName}`

For the full setup flow and troubleshooting, see [Jump host management](/integrations/resource-integrations/microsoft-azure/jump-host-management.md).

## Related pages

* [Jump host management](/integrations/resource-integrations/microsoft-azure/jump-host-management.md)
* [The jump host connector image](/integrations/resource-integrations/microsoft-azure/jump-host-management/jump-host-connector-image.md)
* [Azure app registration](/integrations/resource-integrations/microsoft-azure/azure-app-registration.md)
* [Configure bastion host integration](https://github.com/p0-security/p0-docs/tree/main/integrations/resource-integrations/microsoft-azure/configure-bastion-host-integration.md)