Advanced-Hardened Image for Microsoft Windows Server 2022 Datacenter - Level 2 + Entra ID Login

This Azure-based virtual machine is pre-configured with the latest Microsoft Windows Server 2022 Datacenter, hardened to Level 2 advanced standards and enabled for Microsoft Entra ID (Azure AD) login. Designed for regulated environments, high-security deployments, and organizations requiring stringent compliance controls combined with modern identity-based access.

Unlike standard hardened images which break Entra ID login, this image is specifically engineered to preserve Entra authentication flows while applying advanced hardening controls. Implementing the Level 2 hardened image can help organizations further improve their security posture and better protect against advanced and persistent threats while maintaining Entra ID compatibility.

Ideal for privileged access workstations, regulated industry jump boxes (financial services, healthcare, government), and any scenario requiring both advanced hardening and Entra-based authentication with MFA.

• Entra ID login enabled - Sign in with Entra ID credentials, MFA, and Conditional Access support
• Level 2 advanced hardening - All Level 1 controls plus WDigest disabled, attack surface reduction (ASR) rules, PowerShell logging, location services disabled, cloud telemetry restricted, RPC client restrictions, advanced audit policies
• Marketplace-ready - Pre-configured automation handles Entra registration on customer deployment
• Maps to industry standards - NIST Cybersecurity Framework (CSF), ISO 27000 series, PCI DSS, HIPAA, FedRAMP baseline alignment
• Regulated workload ready - Suitable for PCI DSS scope, HIPAA covered systems, and regulated jump box use cases
• Azure CLI pre-installed - Ready for post-deployment automation

1. Deploy VM from Marketplace
2. RDP in as localadmin using the password set at deployment
3. Open PowerShell as Administrator
4. Run: az login (select your subscription if prompted)
5. Run: C:\MIT\MIT_Customer_EntraSetup.ps1
6. Answer prompts (resource group, VM name, Entra users, access level)
7. VM reboots automatically
8. Connect via mstsc.exe with Advanced tab > "Use a web account to sign in"

Madarson IT certified images are always up to date, secure, follow industry standards, and are built to work right out of the box. Our Entra-enabled images solve the common compatibility issue where standard hardened images break Entra ID login - while maintaining the same advanced hardening posture required for regulated workloads.

• Administrator login name: localadmin

• Entra ID P1 license or higher assigned to users connecting via Entra login
• Connecting client must be Windows 10/11 build 20H1 or later
• Connect using VM hostname (not IP) - configure Azure DNS label or local hosts file

Disclaimer: Microsoft owns the trademarks for Windows, Azure, Entra ID and its associated branding. Madarson IT does not provide commercial license on any product.