fix: Enable Microsoft Entra ID authentication for the jumpbox VM through Azure Bastion

[Saswato-Microsoft]

Purpose

This pull request updates the deployment to enable Microsoft Entra ID (formerly Azure Active Directory) authentication for the jumpbox VM through Azure Bastion, removing the need to manage local admin credentials for RDP access. Documentation and infrastructure scripts are updated to reflect this new authentication flow, making access more secure and user-friendly. Local admin credentials are now auto-generated and not used for sign-in, and guidance for troubleshooting Entra ID-based access is provided.

Infrastructure changes: Microsoft Entra ID authentication for Jump VM

• infra/main.bicep: Installs the AADLoginForWindows extension on the jumpbox VM and assigns the deploying principal the "Virtual Machine Administrator Login" role, enabling Entra ID sign-in via Bastion.
• infra/main.bicepparam: Removes environment-based admin credentials; now sets a default username and generates a deterministic password that is not used for sign-in.

Documentation updates: Sign-in flow and troubleshooting

• docs/ACCESSING_PRIVATE_RESOURCES.md: Updates instructions to show how to connect to the jump VM using Entra ID credentials, removes references to local usernames/passwords, and adds troubleshooting steps for Entra ID authentication. [1] [2]
• docs/deploymentguide.md: Removes references to setting VM admin credentials and clarifies that Bastion uses Entra ID authentication.
• docs/deploy_app_from_foundry.md, docs/post_deployment_steps.md: Updates Bastion connection instructions to use Entra ID authentication, removes local credential references, and adds links to relevant documentation. [1] [2]

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds Microsoft Entra ID authentication for the network-isolated jumpbox VM via Azure Bastion, removing reliance on manually managed local VM credentials.

Changes:

• Generate a non-checked-in jumpbox local admin password and stop reading VM credential env vars in top-layer params.
• Post-configure the existing jumpbox VM to support Entra ID sign-in (AADLoginForWindows extension + RBAC assignment).
• Update docs to reflect Entra ID sign-in flow via Bastion.

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
infra/main.bicepparam	Removes VM credential env var inputs; introduces deterministic generated password and updated comments.
infra/main.bicep	Adds resources to enable Entra ID login on the deployed jump VM (extension + role assignment).
docs/post_deployment_steps.md	Updates Bastion connection instructions to Entra ID authentication and updates screenshot reference.
docs/deploymentguide.md	Removes VM credential configuration guidance; points to Entra ID-based access docs.
docs/deploy_app_from_foundry.md	Updates jump VM access steps to use Entra ID auth via Bastion.
docs/ACCESSING_PRIVATE_RESOURCES.md	Rewrites access/troubleshooting sections to align with Entra ID sign-in and RBAC-based access control.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 10 changed files in this pull request and generated 5 comments.