{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-034-distinguish-the-stored-public-ssh-key-from-the-downloaded-private-key/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-034-distinguish-the-stored-public-ssh-key-from-the-downloaded-private-key/", "slug": "dse-20260917-034-distinguish-the-stored-public-ssh-key-from-the-downloaded-private-key", "url": "https://update.dsesecurity.com/updates/dse-20260917-034-distinguish-the-stored-public-ssh-key-from-the-downloaded-private-key/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-034-distinguish-the-stored-public-ssh-key-from-the-downloaded-private-key.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-034-distinguish-the-stored-public-ssh-key-from-the-downloaded-private-key/" }, "title": "Distinguish the stored public SSH key from the downloaded private key", "summary": "DSE recommends recording the Azure key resource identifier, intended operator, and approved VM access purpose without placing private key material in the change record.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:26+00:00", "modified_at": "2026-09-17T16:35:03+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 2, "word_count": 227, "potentially_affected": "Use this guide when a team creates or registers SSH keys through the Azure portal and needs a clear access handoff for a VM operator.", "dse_recommendation": "DSE recommends recording the Azure key resource identifier, intended operator, and approved VM access purpose without placing private key material in the change record.", "primary_source": { "name": "Create SSH keys in the Azure portal - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/ssh-keys-portal", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s portal workflow downloads the generated private key as a PEM file when the key resource is created. A public key can also be uploaded and stored as an Azure resource, then selected when a VM is created. The region selected for storing the key does not restrict the regions in which it can be used. Microsoft Learn

\n

Applicability

\n

Use this guide when a team creates or registers SSH keys through the Azure portal and needs a clear access handoff for a VM operator.

\n

DSE recommendation

\n

DSE recommends recording the Azure key resource identifier, intended operator, and approved VM access purpose without placing private key material in the change record. Agree where the downloaded private key will be held and how the operator will select it in the SSH client. For an uploaded key, verify that the submitted material is the intended public key. Keep key storage location separate from the VM’s deployment region in the inventory.

\n

Verification

\n

Have the authorized operator check the selected key file and target user before a controlled connection attempt. Record the connection result without exposing the private key. Compare the public key shown in the Azure resource with the approved key record, and resolve an identity mismatch before accepting the handoff.

\n

Official references

\n", "content_text": "Source facts\nMicrosoft’s portal workflow downloads the generated private key as a PEM file when the key resource is created. A public key can also be uploaded and stored as an Azure resource, then selected when a VM is created. The region selected for storing the key does not restrict the regions in which it can be used. Microsoft Learn\nApplicability\nUse this guide when a team creates or registers SSH keys through the Azure portal and needs a clear access handoff for a VM operator.\nDSE recommendation\nDSE recommends recording the Azure key resource identifier, intended operator, and approved VM access purpose without placing private key material in the change record. Agree where the downloaded private key will be held and how the operator will select it in the SSH client. For an uploaded key, verify that the submitted material is the intended public key. Keep key storage location separate from the VM’s deployment region in the inventory.\nVerification\nHave the authorized operator check the selected key file and target user before a controlled connection attempt. Record the connection result without exposing the private key. Compare the public key shown in the Azure resource with the approved key record, and resolve an identity mismatch before accepting the handoff.\nOfficial references\n\nMicrosoft: Create SSH keys in the Azure portal – Azure Virtual Machines | Microsoft Learn", "content_markdown": "## Source facts\n\nMicrosoft’s portal workflow downloads the generated private key as a PEM file when the key resource is created. A public key can also be uploaded and stored as an Azure resource, then selected when a VM is created. The region selected for storing the key does not restrict the regions in which it can be used. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/ssh-keys-portal)\n\n## Applicability\n\nUse this guide when a team creates or registers SSH keys through the Azure portal and needs a clear access handoff for a VM operator.\n\n## DSE recommendation\n\nDSE recommends recording the Azure key resource identifier, intended operator, and approved VM access purpose without placing private key material in the change record. Agree where the downloaded private key will be held and how the operator will select it in the SSH client. For an uploaded key, verify that the submitted material is the intended public key. Keep key storage location separate from the VM’s deployment region in the inventory.\n\n## Verification\n\nHave the authorized operator check the selected key file and target user before a controlled connection attempt. Record the connection result without exposing the private key. Compare the public key shown in the Azure resource with the approved key record, and resolve an identity mismatch before accepting the handoff.\n\n## Official references\n\n- [Microsoft: Create SSH keys in the Azure portal – Azure Virtual Machines | Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/ssh-keys-portal)" }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-034-distinguish-the-stored-public-ssh-key-from-the-downloaded-private-key/", "url": "https://update.dsesecurity.com/updates/dse-20260917-034-distinguish-the-stored-public-ssh-key-from-the-downloaded-private-key/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-034-distinguish-the-stored-public-ssh-key-from-the-downloaded-private-key/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Distinguish the stored public SSH key from the downloaded private key", "item": "https://update.dsesecurity.com/updates/dse-20260917-034-distinguish-the-stored-public-ssh-key-from-the-downloaded-private-key/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-034-distinguish-the-stored-public-ssh-key-from-the-downloaded-private-key/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-034-distinguish-the-stored-public-ssh-key-from-the-downloaded-private-key/", "url": "https://update.dsesecurity.com/updates/dse-20260917-034-distinguish-the-stored-public-ssh-key-from-the-downloaded-private-key/", "headline": "Distinguish the stored public SSH key from the downloaded private key", "description": "DSE recommends recording the Azure key resource identifier, intended operator, and approved VM access purpose without placing private key material in…", "abstract": "DSE recommends recording the Azure key resource identifier, intended operator, and approved VM access purpose without placing private key material in the change record.", "articleBody": "Source facts\nMicrosoft’s portal workflow downloads the generated private key as a PEM file when the key resource is created. A public key can also be uploaded and stored as an Azure resource, then selected when a VM is created. The region selected for storing the key does not restrict the regions in which it can be used. Microsoft Learn\nApplicability\nUse this guide when a team creates or registers SSH keys through the Azure portal and needs a clear access handoff for a VM operator.\nDSE recommendation\nDSE recommends recording the Azure key resource identifier, intended operator, and approved VM access purpose without placing private key material in the change record. Agree where the downloaded private key will be held and how the operator will select it in the SSH client. For an uploaded key, verify that the submitted material is the intended public key. Keep key storage location separate from the VM’s deployment region in the inventory.\nVerification\nHave the authorized operator check the selected key file and target user before a controlled connection attempt. Record the connection result without exposing the private key. Compare the public key shown in the Azure resource with the approved key record, and resolve an identity mismatch before accepting the handoff.\nOfficial references\n\nMicrosoft: Create SSH keys in the Azure portal – Azure Virtual Machines | Microsoft Learn", "datePublished": "2026-09-17T16:34:26+00:00", "dateModified": "2026-09-17T16:35:03+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-034-distinguish-the-stored-public-ssh-key-from-the-downloaded-private-key/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-034-distinguish-the-stored-public-ssh-key-from-the-downloaded-private-key/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Distinguish the stored public SSH key from the downloaded private key" }, "articleSection": [ "IT" ], "keywords": [ "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 227, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create SSH keys in the Azure portal - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/ssh-keys-portal" } } ] } }