Azure

Manage Azure VMs, images, and containers

Filter:

Loading marketplace images…

No marketplace images found.

Name / SKU	Publisher	OS	Actions

Gallery images + standalone Managed Images in your resource group.

Loading images…

No private images found. Upload or capture a VM image to get started.

	Name	Source	OS	State	Actions

Location:

Loading VMs…

No dashboard-deployed Azure VMs found.

Name	State	IP Addresses	Size	Location	Deployed By	Actions
		—				Job

Deploy Azure VM

Image URN or Resource ID *

Marketplace URN publisher:offer:sku:version or full ARM resource ID (managed image / Shared Image Gallery version).

Guest OS:

Trusted Launch (Windows 11 / Compute Gallery image — sets Secure Boot + vTPM + Windows_Client)

Workgroup *

VM Name *

Count *

Batch names are capped at 15 characters so each VM gets a distinct in-guest hostname — keep the base to 12 or fewer to avoid truncation.

VM Size

Location

Subnet *

Network Security Groups

No NSGs found.

Create Public IP

SSH Public Key *

Fetching key from Key Vault…

Key retrieved from vault:

Override secret (optional)

Any Key Vault secret. Must be JSON with a public_key — validated on launch.

Requires Entitle registration enabled; private VMs also need a provisioned Entitle agent.

Onboard into Password Safe (managed system + account)

Requires Password Safe registration enabled; onboards the image's adminuser account, SSH-key managed.

A strong local-admin password is generated automatically and stored in the secrets backend — retrieve it after deploy via VMs → Password. No SSH key is injected on Windows.

BeyondTrust PRA options — optional; fall back to the configured defaults.

Jump group

Gateway

No PRA jump groups/Gateways returned — the shell jump falls back to the configured defaults.

PRA credential

Overrides bt_client_secret for this deploy's shell jump.

Gateway deploy key

Overrides the ACI Gateway deploy key for this deploy.

Bulk Deploy Azure VMs

images selected — one VM per image. To deploy several copies of a single image, use the Count field on the normal deploy form.

VM Names

Shared Settings

Workgroup *

VM Size

Location

Subnet

Network Security Groups (shared, optional)

No NSGs found.

Admin / SSH username (shared)

Create public IP

SSH Public Key

Fetching key from Key Vault…

Key retrieved from vault:

Override secret (optional)

Windows images: each VM gets its own generated admin password, stored in the secrets backend — retrieve via VMs → Password.

This batch mixes Linux and Windows images — Linux VMs use the SSH key above, Windows VMs each get a generated admin password.

Register each Linux VM in Entitle for just-in-time SSH access Onboard each Linux VM into Password Safe (managed system + account)

Capture VM Image

Image Name *

Description

Generalize VM before capture

Warning: The VM will be deallocated and generalized. It will be unusable after this operation.

Skip generalization (faster, but image may have instance-specific settings).

SSH key for

Retrieved from Azure Key Vault secret — this is the canonical private key that pairs with the public key the dashboard injected when the VM was deployed.

Loading…

Keypair mismatch in Key Vault.

The stored public_key does not match the stored private_key. The VM was provisioned with the public_key, so this private key WILL NOT authenticate. Generate a new keypair (e.g. ssh-keygen -t rsa -b 4096), update both fields in the unified Key Vault secret, and redeploy.

Decode error:

✓ Keypair verified — this private key matches the public key on the VM.

SSH command

Private key (paste to ~/.ssh/azure_key, chmod 600)

Copied.

Admin password for

Generated at deploy time and stored in the secrets backend .

Loading…

Username

Password

Copied.

Build Azure Image with Packer

Provision a marketplace image with a shell or PowerShell script and register the result as a new Azure Managed Image. Runs as a tracked background job (typically 10–20 min; Windows builds run longer).

Image Name *

Source Image *

Publisher

Offer

SKU

Build VM Size

Provisioner Script

Load from storage:

Shell script run before the Azure waagent deprovision step (which Packer always runs to generalize the image). PowerShell script run (then a restart) before the Sysprep generalize step, which the build always runs last. Loaded from .

BeyondTrust provisioner options — used by the bt-ready scripts; ignored by other provisioners.

Admin user (Password Safe / Entitle)

Install EPM-L

EPM-L package from

Storage pins the version you synced and doesn't need BeyondTrust reachable from the build — sync it first on the Storage page. Not available on local-filesystem storage.

EPM-L is installed at build; activation runs post-deploy via the EPM-L integration.

Environment variables — passed to the provisioner script.

Secret refs are resolved at build start and passed via Packer sensitive variables — never written to the generated or archived template.

Archive generated template to Azure Blob Storage

OT Demo Cell

Deploy a simulated plant cell — a Modbus PLC simulator (:502) + FUXA web HMI (:1881) from the Packer-baked ot-sim gallery image — with no public IP, and BeyondTrust access auto-wired: Web Jump → HMI, protocol tunnel → PLC port, plus the Shell Jump and optional Password Safe onboarding every Azure deploy gets. Bake the image first on the Build Image tab (Debian 12 preset + provisioners/ot/ot-sim-debian.sh).

Deploy a cell

Image * show all private images

No ot-sim image yet — build one on the Build Image tab, or tick "show all".

VM Name *

VM Size

Location

Workgroup *

Subnet *

The cell gets no public IP — access is PRA-brokered only, which is the point.

Network Security Groups

No NSGs found.

PLC Protocols (one tunnel each)

The cell simulates all of these at once — each gets its own PRA protocol tunnel, so access can be granted per vendor. Protocols the image does not simulate (e.g. DNP3) stay available on the standalone tunnel card below.

BeyondTrust PRA placement — where the cell's jump items land; defaults are the configured azure_bt_jump_group_name / azure_jumpoint_name.

Jump group

Gateway

Pick the pair matching the cell's region. With a Gateway override the deploy skips the shared-gateway size check — the host behind that Gateway needs ≥2 GB RAM for the Web Jump.

Onboard the cell's admin account into Password Safe (+ a synced PRA Vault account for checkout/injection) Register the VM in Entitle for just-in-time SSH access

The gateway backing the Web Jump needs ≥2 GB RAM (azure_jumpoint_vm_size Standard_B1ms minimum, Standard_B2s preferred — Settings → Integrations → Privileged Remote Access) — the deploy checks and refuses early with the remedy otherwise.

Cells

No OT cells yet.

Standalone OT Protocol Tunnel

A generic-TCP PRA protocol tunnel to any host the gateway can reach — for demoing against your own lab gear without deploying a cell.