Subject: AADSSHLoginForLinux — offline provisioning with preinstalled aadsshlogin on Ubuntu 24.04

For a supported regular Azure VM deployment, permit packages.microsoft.com directly or through an HTTP proxy while provisioning AADSSHLoginForLinux; Microsoft does not document an offline/preinstalled-package provisioning procedure for Ubuntu 24.04.

Supported behavior

• Ubuntu 24.04 is supported by Microsoft Entra SSH on regular Azure VMs.
• The documented VM requirements include:
  • A system-assigned managed identity.
  • A running Azure Linux VM Agent.
  • The AADSSHLoginForLinux extension.
  • The aadsshlogin package installed by that extension.
• The documented network requirements identify:
  • https://packages.microsoft.com for package installation and upgrades.
  • https://login.microsoftonline.com for PAM authentication.
  • https://pas.windows.net for Azure RBAC authorization.
  • http://169.254.169.254 for Azure Instance Metadata Service (IMDS).
    The HTTPS endpoints use TCP 443; IMDS is a direct, link-local HTTP endpoint and must not be sent through a proxy.^1^

Therefore, preinstalling aadsshlogin in a custom image does not satisfy the documented extension-provisioning requirements by itself.

Answers to the specific questions

Does the handler contact packages.microsoft.com if the target package is already installed?

The public documentation says the extension installs the packages, always installs the latest applicable package, and requires packages.microsoft.com for installation and upgrades. It does not document a package-version short-circuit that guarantees the repository will be skipped when an identical package is already present.^1^

Consequently, an image containing the package should not be treated as evidence that extension provisioning can complete without repository access. The package can be installed while the Azure extension resource remains failed or Transitioning.

Is offline provisioning supported?

No supported offline procedure is publicly documented for AADSSHLoginForLinux on a regular Azure VM. In particular, Microsoft does not publish an offline compatibility matrix containing:

• A handler version that bypasses repository access.
• A package version to pin for Ubuntu 24.04.
• An extension setting that enables offline mode.
• A procedure for marking a preinstalled package as successfully provisioned by the extension.

Microsoft documents offline installation separately for products that support it—for example, SQL Server packages—but the general Microsoft Linux repository documentation does not make offline installation universally applicable to every product.^2^

Supported deployment through a controlled proxy

If direct allowlisting is prohibited, the remaining publicly documented path is to give the Azure Linux Agent controlled proxy access during extension installation.

1. On the VM, edit:

      /lib/systemd/system/walinuxagent.service
   

2. Add these entries after [Service], substituting the approved proxy:

      [Service]
      Environment="http_proxy=http://proxy.example.com:80/"
      Environment="https_proxy=http://proxy.example.com:80/"
      Environment="no_proxy=[IP Address]"
   

3. Reload systemd and restart the agent:

      sudo systemctl daemon-reload
      sudo systemctl restart walinuxagent
   

4. Ensure the VM has a system-assigned managed identity, then retry the extension on the regular VM:

      az vm extension set \
        --publisher Microsoft.Azure.ActiveDirectory \
        --name AADSSHLoginForLinux \
        --resource-group <resource-group> \
        --vm-name <vm-name>
   

The documented successful result is extension provisioningState set to Succeeded.^1^

Verify extension provisioning separately from package installation

Check the live extension instance view, not only dpkg:

az vm get-instance-view \
  --resource-group <resource-group> \
  --name <vm-name> \
  --query "extensions[].{name:name,type:type,version:typeHandlerVersion,status:statuses[0].displayStatus}" \
  --output table

Instance view reports the actual handler version and runtime status; model view only records the requested configuration.^3^

You can independently inspect the package:

dpkg-query -W -f='${Package} ${Version} ${Status}\n' aadsshlogin

A successful dpkg-query result does not imply that the extension reached Provisioning succeeded.

Connectivity after provisioning

Normal Entra SSH authentication continues to require access to:

• login.microsoftonline.com for authentication.
• pas.windows.net for RBAC authorization.
• [IP Address] directly for Azure instance metadata.

packages.microsoft.com is documented for package installation and upgrades, rather than each authentication transaction. It must become reachable again when package installation or upgrading is performed.^1^

Extension-handler upgrades are a separate lifecycle from aadsshlogin package upgrades. autoUpgradeMinorVersion selects a newer minor handler at deployment time; enableAutomaticUpgrade controls subsequent automatic handler upgrades. Instance view is the appropriate place to verify the handler actually running.^3^ Neither setting provides a documented offline package-provisioning mode.

References

1. Sign in to a Linux virtual machine in Azure by using Microsoft Entra ID and OpenSSH
2. Linux Software Repository for Microsoft Products
3. Virtual machine extensions and features for Linux