In this demonstration,
we'll start by my showing you how to configure Azure AD
sign‑in for a Windows virtual machine.
Here we are in the Azure portal,
looking at a Windows Server 2022 Datacenter box that I've got in Azure,
it's called rootdc3.
If I go over to Networking,
we can inspect its networking. It's in a VNet called
cloud‑vnet on subnet named server.
And I am not going to involve this rootdc3 at this
time in a local on‑premises Azure AD.
Instead, I want to be able to sign in using not a local account,
or even install AD DS on the VM and login in a domain account; I want
to sign in with my tim@timw.info Azure AD account.
Well, how do I do that?
Well, what we want to do, since the VM is already created,
is install the AADLoginForWindows extension.
And I'm going to do that with Azure command line interface.
Again, I give you this AZ CLI script file in the course files.
What you'll want to do in Visual Studio Code is you'll want
to install the Azure CLI Tools extension,
and you'll also want to install the Azure CLI Binaries on your local system.
It's a Python application,
and it gives you that cross‑platform shell that some people really,
really like.
As you see here, we run az login to sign into Azure,
and I did an az account set to set my proper subscription context,
and now to inject that extension that enables Azure AD log on,
I'm going to do az vm extension set, as you can see,
the publisher, the name,
and then the resource group and name of my virtual machine.
Let me select this code, right‑click, and Run Line in Terminal.
Now,
the reason why I have syntax highlighting and auto
complete and all of that good stuff is because I've
installed the Azure CLI Tools extension,
and the reason why the code is running is because I
have the Azure CLI installed.
Now normally, you can use the back‑slash as a line terminator,
but it looks like that kind of choked VS Code.
So what I'm going to do is quickly refactor here to
get rid of those line separators.
Okay, now that I've put the command on one line,
let me right‑click Run Line in Terminal,
and it looks like it's going to go through this time.
Now the rest of the sample code I have here just
involves granting RBAC permissions,
but I'm going to show you how to do that in the portal.
I think it's just going to be more effective that way.
So for the virtual machine access control IAM blade,
let's do a role assignment here.
We'll do Add Role Assignment, and in this case,
we'll filter the list for virtual machine.
I want to sign in as an administrator,
so I'm going to assign myself the Virtual Machine Administrator Login role,
and again, it bears repeating that even though I'm a subscription owner,
once you enable Azure AD sign‑in to a virtual machine,
you're not going to be able to sign in with your credential,
unless you're a member of this, or should I say,
you've been assigned this role.
So let me search the directory for my tim@ account.
Let me bring myself into scope here, let's proceed, and then Review and Assign.
Nice.
We'll come back to VS Code, make sure that we got JSON back,
the provisioningState has succeeded; that's exactly what I wanted to see.
We might want to reboot the VM just to be sure,
so let me go to Overview and Restart.
Now to complete the process, let's do a Connect RDP.
I do happen to have a public IP address on this instance.
I have just‑in‑time VM access configured, so I'll request access.
I actually did that a moment ago, and I downloaded the RDP file.
Let me right‑click on Edit and show you how you sign in.
For username, it's going to be AzureAD\, then the user portion of your user ID.
So my tim@timw.info Azure AD account is being
represented in this down‑level way.
It's kind of backwards, but there you have it.
Okay, I'm going to put in my Azure Active Directory password,
and momentarily,
we are being signed into that virtual machine with Azure Active Directory credentials.