# Distinguish the stored public SSH key from the downloaded private key

> DSE recommends recording the Azure key resource identifier, intended operator, and approved VM access purpose without placing private key material in the change record.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-034-distinguish-the-stored-public-ssh-key-from-the-downloaded-private-key/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:26+00:00
- Modified: 2026-09-17T16:35:03+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 2 minutes

## What you need to know

DSE recommends recording the Azure key resource identifier, intended operator, and approved VM access purpose without placing private key material in the change record.

## Potentially affected

Use this guide when a team creates or registers SSH keys through the Azure portal and needs a clear access handoff for a VM operator.

## DSE recommendation

DSE recommends recording the Azure key resource identifier, intended operator, and approved VM access purpose without placing private key material in the change record.

## Article

## Source facts

Microsoft’s portal workflow downloads the generated private key as a PEM file when the key resource is created. A public key can also be uploaded and stored as an Azure resource, then selected when a VM is created. The region selected for storing the key does not restrict the regions in which it can be used. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/ssh-keys-portal)

## Applicability

Use this guide when a team creates or registers SSH keys through the Azure portal and needs a clear access handoff for a VM operator.

## DSE recommendation

DSE recommends recording the Azure key resource identifier, intended operator, and approved VM access purpose without placing private key material in the change record. Agree where the downloaded private key will be held and how the operator will select it in the SSH client. For an uploaded key, verify that the submitted material is the intended public key. Keep key storage location separate from the VM’s deployment region in the inventory.

## Verification

Have the authorized operator check the selected key file and target user before a controlled connection attempt. Record the connection result without exposing the private key. Compare the public key shown in the Azure resource with the approved key record, and resolve an identity mismatch before accepting the handoff.

## Official references

- [Microsoft: Create SSH keys in the Azure portal – Azure Virtual Machines | Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/ssh-keys-portal)

## Primary reference

- Name: Create SSH keys in the Azure portal - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/ssh-keys-portal
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Distinguish the stored public SSH key from the downloaded private key,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-034-distinguish-the-stored-public-ssh-key-from-the-downloaded-private-key/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.