Terraform Azure Linux VM with Azure AD Access - azure

Question

I am trying to provision a simple Ubuntu Linux VM with Terraform that allows users to connect with their Azure AD credentials. I am new to Terraform and am trying to I'm trying to find the right resource section/command that enables the "Login with Azure AD" setting from the GUI shown in the screenshot link below.
https://i.stack.imgur.com/Gg9p8.png
Here is a snippet of code that provisions the VM:
resource "azurerm_linux_virtual_machine" "dev" {
name = "devhost01"
resource_group_name = azurerm_resource_group.dev.name
location = azurerm_resource_group.ev.location
size = "Standard_D2s_v3"
admin_username = "admin"
network_interface_ids = [
azurerm_network_interface.dev.id,
]
admin_ssh_key {
username = "admin"
public_key = file("~/.ssh/admin.pub")
}
os_disk {
caching = "ReadWrite"
storage_account_type = "Standard_LRS"
}
source_image_reference {
publisher = "Canonical"
offer = "UbuntuServer"
sku = "18.04-LTS"
version = "latest"
}
}
I have a related but secondary question as well; I am unsure if it warrants a separate question/post. I manually created a VM through the GUI enabling "Login with Azure AD", tried to connect with
az ssh vm --ip XXX.XXX.XXX.XXX
and received
Permission denied (publickey).
I haven't specified that users need to connect using ssh keys (at least not intentionally). Is there another section I need to add to allow basic SSH access for authenticated AD users?

Answer 1

To logon to a linux VM with Azure AD. You would need to perform below actions.
Install AAD linux extension, which appears to be installed as per your screenshot
Enable System assigned Managed Identity which facilitates the AD login. I see this also being created.
As mentioned in “Azure AD” section on your screenshot, you would need to assign one of Virtual Machine Administrator Login or Virtual Machine User Login roles via RBAC on the VM resource.
The third one is equally important like it’s predecessors to allow AD logins.
When all three steps are performed, az ssh vm --ip XXX.XXX.XXX.XXX would let you logon to the VM.
Update
---- adding tf code as requested in comments-----
add managed identity to VM resource
resource "azurerm_linux_virtual_machine" "dev" {
// blah-blah
identity {
type = "SystemAssigned"
}
}
add role assignment
resource "azurerm_role_assignment" "assign-vm-role" {
scope = azurerm_linux_virtual_machine.dev.id
role_definition_name = "Virtual Machine Administrator Login"
principal_id = <id-of-group/user/sp>
}