Azure Compliance ControlsAzure Virtual Machines
Linux machines should require SSH keys for authentication
Using passwords with SSH still leaves the VM vulnerable to brute-force attacks. The most secure option for authenticating to an Azure Linux virtual machine over SSH is with a public-private key pair, also known as SSH keys.
What this control checks
Linux machines must require SSH keys for authentication
Framework mappings
The clauses this control is mapped to in each framework.
- Access Enforcement (AC-3)
- IA-5: Authenticator Management
FedRAMP Moderate Baseline Rev 4
- AC-3 Access Enforcement
- IA-5 (1): Password-Based Authentication
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
RBI Cyber Security Framework for UCBs
- Annex I (7.3)
- IAM-03.01AC The cloud service provider monitors the context of authentication attempts, e.g. IP addresses, the date and time or the device used, and flags suspicious events to authorised persons, as relevant.
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- AC-3 Access Enforcement
- IA-5 Authenticator Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_ssh_key_authentication_linux - Powerpipe Control:
azure_compliance.control.compute_vm_ssh_key_authentication_linux - Prowler Check:
vm_linux_enforce_ssh_authentication - Azure Policy Definition:
630c64f9-8b6b-4c64-b511-6544ceff6fd6
Last reviewed: 2026-10-11