Ability to monitor Cloudshell with Azure Policy (vnet, storage, logging, RBAC)

[jdelabr]

Dear all,

We need a way to be able to audit and enforce the following:

• VNet integration
• Use of compliant Storage account (with logging, no exposure to internet and CMK)
• Log all commands passed onto cloudshell

In addition we would require the ability to manage and audit privileges to use cloudshell at Azure RBAC level.

Thank you in advance!

Kind regards,
Julien

[maertendMSFT]

Would folks prefer these types of controls at a subscription or tenant level?

[jdelabr]

@maertendMSFT
Those would be best managed via Azure policy in my opinion, which I understand can be applied to subscriptions and/or management groups.

[kirkwhetton]

Either of those would be preferable to nothing at all! Upvoted.

[chrisking81]

My FSI customer needs to fully disable Cloud Shell, as it provides a container running in an unfiltered vNet, with direct access to the internet.

Disabling for the whole tenant would be the best option, as I assume it would also disable the ability to mount the Cloud Shell in VS Code and Windows Terminal as well.

Allowing a potential special group of users (Cloud Ops) to use under breakglass/PIM elevation could be a bonus.

[MiloCoding123]

Does anyone have a script that automatically creates and monitors breakglass accounts? I'm trying to make one with the new AzureAD module but if anyone already has one it will be greatly appreciated! Its on powershell