Linux machines should prohibit remote connections from accounts without passwords
Requires that prerequisites are deployed to the policy assignment scope. Machines are non-compliant if Linux machines that allow remote connections from accounts without passwords. The Azure Policy check uses the Guest Configuration category.
What this control checks
Linux machines that allow remote connections from accounts without passwords are non-compliant
Common pitfalls
Prerequisites must be deployed to the scope
Requires that prerequisites are deployed to the policy assignment scope.
Arc machines are excluded by default
IncludeArcMachines has the default value "false". By selecting this option, you agree to be charged monthly per Arc connected machine.
Effect is AuditIfNotExists or Disabled
The effect parameter has the allowed values AuditIfNotExists and Disabled. The defaultValue is AuditIfNotExists.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Audit Linux machines that allow remote connections from accounts without passwords" (ea53dbee-c6c9-4f0e-9f9e-de0039b78023); PowerPipe control azure_compliance.control.compute_vm_restrict_remote_connection_from_accounts_without_password_linux.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-17 (Remote Access) and AC-17(1) (Monitoring and Control).
FedRAMP Moderate Baseline Rev 4: Mapped to AC-17 (Remote Access) and AC-17(1) (Automated Monitoring/Control).
Framework mappings
The clauses this control is mapped to in each framework.
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
FedRAMP Moderate Baseline Rev 4
- AC-17 (3): Managed Access Control Points
- AC-17(1) Automated Monitoring/Control
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.12: Monitor and control remote access sessions.
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L2-3.1.12 Monitor and control remote access sessions
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
Related controls
- Virtual machines should have a vulnerability assessment solution enabled
- Virtual machines should use managed disks
- Virtual machines should use managed disks for OS and data disks
- Azure subscriptions should not have guest accounts with read permissions
- Microsoft Admin Portals should require multifactor authentication
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_restrict_remote_connection_from_accounts_without_password_linux - Powerpipe Control:
azure_compliance.control.compute_vm_restrict_remote_connection_from_accounts_without_password_linux - Azure Policy Definition:
ea53dbee-c6c9-4f0e-9f9e-de0039b78023
Last reviewed: 2026-10-11