An awesome feature to bring some sanity to Azure VM authentication and authorization is using Microsoft Azure Windows and Linux Virtual Machine Sign-in functionality. You can quickly test this by selecting the Login with Azure AD check box during provisioning.
I wanted to add MFA and User Sign In risk checks using conditional access before a user can actually log into the VM. When setting up my policy, I could not find Microsoft Azure Windows Virtual Machine Sign-in or Microsoft Azure Linux Virtual Machine Sign-in app. I was puzzled, so I quickly checked my commercial tenant and sure enough it existed. I initially thought it was one of those not in gov cloud, but only commercial cloud situation. I created a ticket to support and they came back noting that they have seen Microsoft applications missing in GCC High tenants. The quick fix is just to manually add the missing applications. Once they told me the application Id’s are the same, we can quickly just create it.
New-AzureADServicePrincipal -AppId '372140e0-b3b7-4226-8ef9-d57986796201' #Microsoft Azure Windows Virtual Machine Sign-in
New-AzureADServicePrincipal -AppId 'ce6ff14a-7fdc-4685-bbe0-f6afdfcfa8e0' #Microsoft Azure Linux Virtual Machine Sign-InAfter running those PowerShell cmdlet’s in my cloud shell, I can now successfully see the apps during conditional access creation.
Azure Testing Site 
This is a great fix to a known Microsoft problem, it is sad they know about it, but refuse to fix it. It has affected me with just a general azure trial. Thanks for your quick and easy fix. Unfortunately, you also need an active Azure Subscription. I used a pay as you go, free version to run the cloud script.
LikeLike
This is a great fix to a known Microsoft problem, it is sad they know about it, but refuse to fix it. It has affected me with just a general azure trial. Thanks for your quick and easy fix. Unfortunately, you also need an active Azure Subscription. I used a pay as you go, free version to run the cloud script.
LikeLike