How to manage Azure virtual machines from one Windows app

1. 1

   Step 1: Register an app in Microsoft Entra ID

   In the Azure portal, open Microsoft Entra ID → App registrations → New registration. Give it a name such as remoteaccessapp and register it. On its overview page, copy the Directory (tenant) ID and the Application (client) ID.

2. 2

   Step 2: Create a client secret and copy its Value

   In the app registration, choose New client secret under Certificates & secrets. Copy the secret's Value straight away: Azure shows it only once. The Secret ID next to it is not the secret.

3. 3

   Step 3: Give the app the Reader role

   Open the subscription, or a single resource group, then Access control (IAM) → Add role assignment. Choose Reader and assign it to your app registration. That's enough to import. Add Virtual Machine Contributor only if you want to start and stop VMs from the app.

4. 4

   Step 4: Add the account in the app

   In the RemoteAccessApp app, open the Connections page, click the arrow next to Add host, choose Cloud accounts…, then Azure. Paste the tenant ID, the client ID and the secret's Value. Leave Subscription IDs empty to list every subscription the app can see, or enter the ones you want.

   Click Test connection. It confirms the app can sign in, says how many subscriptions it can see and names any you listed that it can't. Then Save.

5. 5

   Step 5: Import the VMs

   Click Import servers…, tick the VMs you want and click Import. Windows VMs become Remote Desktop hosts on port 3389 and Linux VMs SSH hosts on port 22, each with the admin user name set on the VM.

The app adds other cloud accounts the same way: see how to manage AWS EC2 and Lightsail servers or manage DigitalOcean Droplets. The cloud servers help article sums up all three providers on one page.

• A folder per region or resource group puts each VM in a folder like Azure · my-resource-group. Otherwise they go in Cloud.
• Connect to private IPs instead of public ones, for VMs you reach over a VPN or from the same virtual network. A VM with no public IP is imported with its private IP anyway.
• Key for the Linux servers: the private key that matches the public key you gave the VMs. It's added to your key list once and used by the imported SSH hosts.
• Add their tags turns the VMs' Azure tags into host tags.

The address is the first public IP of the VM's primary network interface. Scale set instances aren't listed, only virtual machines.

An imported VM shows an Azure badge on its row, with its state when it isn't running, such as Azure · deallocated. Right-click it (or use its ⋯ menu) and open the Azure submenu:

• Start runs straight away.
• Stop… powers the VM off but keeps it allocated, so Azure still bills its compute.
• Deallocate… stops it and releases the compute, so that isn't billed. A dynamic public IP is released too and changes on the next start.
• Reboot… restarts it. Anyone connected is disconnected.

Stop, Deallocate and Reboot ask before they do anything. The row's state follows along for up to 3 minutes, and Refresh from cloud reads it again whenever you like, along with the IP address. If the app is missing the role for an action, the error names the action and the roles that allow it.

A Windows VM opens in a Remote Desktop tab, where you sign in with its admin password. A Linux VM opens in an SSH tab with your key: check the server's key fingerprint the first time (see server keys). The VM's network security group has to allow Remote Desktop or SSH from where you are. The RDP and VNC manager and SSH client pages show what each tab can do.

Your PC signs in to Microsoft and talks to Azure directly; nothing goes through RemoteAccessApp's servers. The client secret is stored encrypted for your Windows account, is never shown again after you save it, and is never written to logs. With Save to my vault on and your password vault syncing (Pro), the account is also kept in your end-to-end encrypted vault for your other PCs. Client secrets expire: when one does, the app says so, and you paste a new Value into the account.

Why keep your VMs in the same app as your PCs, and how are the keys looked after? The post one place for your cloud servers and your PCs goes through both.

Cloud accounts, importing and the power actions work on the free plan. Each imported VM is a saved host, and the free plan has up to 5 saved hosts and web panels together; Pro removes the limit. To get started, download RemoteAccessApp.