Distinguish the stored public SSH key from the downloaded private key

Source facts

Microsoft’s portal workflow downloads the generated private key as a PEM file when the key resource is created. A public key can also be uploaded and stored as an Azure resource, then selected when a VM is created. The region selected for storing the key does not restrict the regions in which it can be used. Microsoft Learn

Applicability

Use this guide when a team creates or registers SSH keys through the Azure portal and needs a clear access handoff for a VM operator.

DSE recommendation

DSE recommends recording the Azure key resource identifier, intended operator, and approved VM access purpose without placing private key material in the change record. Agree where the downloaded private key will be held and how the operator will select it in the SSH client. For an uploaded key, verify that the submitted material is the intended public key. Keep key storage location separate from the VM’s deployment region in the inventory.

Verification

Have the authorized operator check the selected key file and target user before a controlled connection attempt. Record the connection result without exposing the private key. Compare the public key shown in the Azure resource with the approved key record, and resolve an identity mismatch before accepting the handoff.

Official references

• Microsoft: Create SSH keys in the Azure portal – Azure Virtual Machines | Microsoft Learn