Azure Stack Hub: Accessing the Privileged Endpoint (PEP)

As a Cloud Operator responsible for managing an Azure Stack Hub system you need to be familiar with how to use the Privileged Endpoint (PEP). The Microsoft Documentation is a great place to get started, but there are a couple additional tips that I’ve gathered that aren’t covered in the documentation.

Tip 1: You don’t need Get-Credential

Instead of taking the step if acquiring the credential and storing it in a variable, just pass the CloudAdmin user name to the New-PSSession cmdlet in the -Credential parameter. When the command runs it will prompt you for the password.

$Session = New-PSSession `
    -ComputerName "Azs-ERCS01" `
    -Configuration "PrivilegedEndpoint" `
    -Credential "CloudAdmin"

Tip 2: Enter-PSSession vs Import-PSSession

Azure Stack Hub was designed from the beginning with these core security principles:

  • Hardened by Default — minimize the attack surface to prevent intrusion
  • Assume Breach — limit the blast radius in the event an intrusion occurs

To meet these requirements Azure Stack Hub uses a Just Enough Administration (JEA) shell for advanced management operations. This secure shell limits the commands that can be run to just those that have explicitly allowed by Microsoft. One of the side effects is that you no longer have tab completion when you use Enter-PSSession. For most commands you can work around this limitation by:

  • Using Invoke-Command against the Privileged Endpoint Session
  • Using Import-PSSession to import the Privileged Endpoint session into the current PowerShell session

The first option can get difficult as you have to construct your commands to fit cleanly into the ScriptBlock parameter, and any variable being passed in need to use the $using syntax. The latter option makes things much cleaner as you retain tab completion and intellisense, and require no special handling for parameters.

Tip 3: Store the results of Import-PSSession in a variable

$Module = Import-PSSession -Session $Session

When you use Import-PSSession, it imports the session commands in a temporary module with a randomly generated name. By storing this module information in a variable it makes it significantly easier to remove that module when it’s no longer needed. This is especially helpful when disconnecting from one PEP session to start another one.

Remove-Module -Name $Module.Name

By simply running the above line you can clear the temporary module and be ready to connect to another Privileged Endpoint.