Distinguish an SSH default reset from restoration of the previous configuration

Source facts

The Azure CLI reset-ssh operation replaces sshd_config with a default configuration from the extension’s internal resources; it does not restore the VM’s original file. VMAccess also backs up and changes SSH configuration during user updates, setting challenge-response authentication off and password authentication on. Its restore_backup_ssh option restores the backed-up configuration. VMAccess user operations grant sudo privileges to the specified account. Microsoft Learn.

Applicability

Use this distinction during authorized access recovery, especially where the VM had deliberately customized SSH settings. Treat account recovery and restoration of the approved SSH policy as separate completion items.

DSE recommendation

Choose default reset or backup restoration according to the intended SSH configuration outcome. Have the recovery owner record whether the intended result is a distro default or the prior backed-up configuration. Preserve a safe administrative access path while comparing the recovered settings with the approved policy. Avoid using this recovery extension as a routine way to manage an unprivileged account.

Verification

Rehearse the chosen operation on a representative nonproduction VM and inspect the resulting SSH configuration. Test the intended authentication path and review the recovered account’s privileges. Before closing the incident, reconcile any temporary authentication changes with the approved configuration and document the outcome without passwords or private keys. A successful login alone should not replace the configuration comparison.

Official references

Microsoft Learn: VMAccess Extension for Linux. Source reviewed September 9, 2026.