Can I use Entra ID SSO for SSH to an on-prem Ubuntu VM?

Take a look at Ubuntu's authd with the authd-msentraid broker. It connects Entra authentication to Linux PAM and supports SSH login using a device code flow, so it doesn't require a desktop on the server.

That flow may ask the user to complete authentication in a browser on another device. Check the authd SSH documentation for the setup and client requirements, and test the login and account policies before relying on it for administration.

SSSD is another route if your Ubuntu version has a suitable release. SSSD 2.11 added direct identity provider login support, including Entra. Check the version packaged for your release and the identity provider configuration details before choosing this approach.

If the VM can be registered with Azure Arc, that's another option to investigate. It may let you use the Azure Linux SSH extension on an on-prem machine, rather than building the authentication integration entirely by hand.

Keep the distinction between login methods in mind. A one-time code through Google Authenticator can add a second factor to SSH, but that isn't the same thing as authenticating the user through Entra. Likewise, the Linux desktop SSO instructions aren't necessarily a recipe for a headless SSH server.

For the audit requirement, check which sign-in and server-side logs the chosen setup actually produces. Using Entra for authentication alone doesn't establish what your audit trail will contain.