Security is the most critical dimension of virtual machine management. The following practices reduce your attack surface and protect your workloads from both external threats and internal mis-configurations.

• Enable Just-In-Time (JIT) Network Access Control : Virtual machines should have Just-In-Time network access control enabled. JIT restricts access to management ports — such as SSH (port 22) and RDP (port 3389) — by keeping them closed by default and only opening them temporarily when access is explicitly requested.

  Without JIT, management ports may remain permanently open, significantly increasing the attack surface and exposing VMs to brute-force attacks. Enabling JIT access minimizes the risk of unauthorized access and is a foundational security measure for any production VM.

• Disable Password Authentication on Linux VMs : SSH passwords are prone to brute-force attacks and are considered less secure than key-based authentication. SSH keys are cryptographically strong and significantly harder to compromise compared to passwords.

  It is strongly recommended to, disable password-based SSH authentication on all Linux virtual machines. Use SSH key pairs for all remote access and store private keys securely and rotate them periodically.

• Enable Encryption at Host : Encryption at host provides end-to-end encryption by encrypting data on the VM host before it reaches Azure storage. This includes:

  -Temporary disks

  -Ephemeral OS disks

  -OS and data disk caches

  Without this feature, temporary disks and caches may contain unencrypted data, creating compliance gaps. Enabling encryption at host ensures no unencrypted data resides on the VM host and helps meet security compliance requirements such as ISO 27001, SOC 2, and PCI-DSS.

• Enable Secure Boot : Secure Boot protects virtual machines from unauthorized modifications to the boot chain, including bootkits, rootkits, and kernel-level malware. It verifies the integrity of each component in the boot sequence and only allows trusted, signed components to run.

  Enabling Secure Boot on supported VMs adds a critical layer of protection against low-level threats that traditional antivirus tools cannot detect. 

• Enable Virtual Trusted Platform Module (vTPM) : The Virtual Trusted Platform Module (vTPM) provides enhanced security to the guest operating system. Key benefits include:

  -Generating and securely storing encryption keys and sensitive data

  -Enabling full-disk encryption capabilities for virtual machines

  -Supporting Measured Boot, which detects and records boot integrity

  Enabling vTPM adds an additional layer of OS-level security and supports a Zero Trust security posture for your VM infrastructure.

• Deploy IaaS Antimalware Extension (Windows VMs) : Windows virtual machines should have the Microsoft IaaS Antimalware extension deployed. Microsoft Antimalware for Azure is a free, real-time protection solution that:

  -Identifies and removes viruses, spyware, and other malicious software

  -Generates alerts when known malicious or unwanted software attempts to install or run

  -Integrates with Microsoft Defender for Cloud for centralized visibility

  This extension is a baseline security requirement for all Windows server workloads on Azure.
  “If Microsoft Defender for Servers (Plan 1 or Plan 2) is enabled, the IaaS Antimalware Extension is not required, as Defender for Endpoint is automatically onboarded and provides real-time antimalware protection. For environments without Defender for Servers, deploying the IaaS Antimalware Extension remains a recommended baseline.”

• Sign In to Windows VMs Using Microsoft Entra ID : Virtual machines should be configured to allow sign-in using Microsoft Entra ID (formerly Azure AD) instead of relying on local administrator accounts. Entra ID-based sign-in eliminates the risks associated with managing local credentials at scale — when an employee leaves, revoking their Entra ID account immediately removes their access to all virtual machines. Access is governed through Azure RBAC roles such as Virtual Machine Administrator Login and Virtual Machine User Login, giving teams fine-grained control over who can access which machines. Additionally, organizations can enforce Conditional Access policies — such as phishing-resistant MFA, device compliance checks, and location-based restrictions — before granting RDP access to a VM. This approach supports a Zero Trust security model and significantly reduces the risk of unauthorized access through compromised local credentials.