---
title: Fortifying security for Ubuntu on Azure with Metadata Security Protocol (MSP)
description: Enable Azure’s MSP on Ubuntu to harden IMDS/WireServer with signed, identity-aware
  requests via azure-proxy-agent. Available now for testing; LTS SRUs planned.
url: https://canonical.com/blog/fortifying-security-ubuntu-azure-metadata-security-protocol-msp
---

1. [Blog](https://canonical.com/blog)
2. Article

---

[Jehudi](https://canonical.com/blog/author/jota-ce "More about Jehudi")

29 September 2025

# Fortifying security for Ubuntu on Azure with Metadata Security Protocol (MSP)

---

Share the article

We’re pleased to share a security enhancement for Ubuntu workloads on Microsoft Azure. In collaboration with Microsoft, Ubuntu now supports Azure’s Metadata Security Protocol (MSP)—a feature that hardens access to the Instance Metadata Service (IMDS) and WireServer. On Ubuntu, MSP is enabled by the azure-proxy-agent package, Canonical’s integration of [Microsoft’s Guest Proxy Agent (GPA)](https://github.com/Azure/GuestProxyAgent.).

## Why MSP raises the baseline

Traditional metadata endpoints are default-open within a VM. That leaves room for confused-deputy/SSRF paths and sandbox escapes. MSP flips this to default-closed with strong controls at the metadata boundary:

* **Strong authentication**. IMDS/WireServer accept only requests endorsed (HMAC-signed) by a trusted in-guest delegate (GPA/azure-proxy-agent). Unsigned traffic is rejected.
* **Identity-aware authorization**. The agent uses eBPF to intercept IMDS and WireServer requests and identify the originating process and user. It then checks an allowlist before endorsing the request (granular, per-endpoint RBAC).
* **Safe by default**. Even if guest firewall rules are misconfigured or bypassed, unauthenticated traffic still cannot reach the metadata services.

For architecture and Azure-side configuration, see [Microsoft’s MSP documentation](https://learn.microsoft.com/azure/virtual-machines/metadata-security-protocol/overview).

*MSP must be enabled in Azure. Installing the Ubuntu package alone does not turn on MSP. Enable MSP for the VM/VMSS from the Azure side (Portal/CLI/template) so requests are validated and unsigned traffic is rejected.*

## Availability and roadmap

The azure-proxy-agent package is available now for testing and is in the development series for Ubuntu 25.10 “Questing Quokka.”

After we incorporate feedback and verify stability, we plan to deliver azure-proxy-agent to Ubuntu 25.04 (Plucky Puffin), Ubuntu 24.04 LTS (Noble Numbat) and Ubuntu 22.04 LTS (Jammy Jellyfish) through the Stable Release Updates (SRU) process.

## Early testing on LTS

For Ubuntu 24.04 LTS and 22.04 LTS, azure-proxy-agent is currently available in -proposed. If you’re comfortable testing SRU candidates, enable -proposed temporarily and pin only this package so you don’t upgrade unrelated components. Background on -proposed and SRUs: [Stable Release Updates](https://documentation.ubuntu.com/sru/en/latest/)

Generic, codename-aware snippet (works for Jammy/Noble/Plucky):

```
# Resolve codename (prefers /etc/os-release; falls back to lsb_release)
CODENAME="$(. /etc/os-release 2>/dev/null; echo ${VERSION_CODENAME:-$(lsb_release -cs)})"

# Pin only azure-proxy-agent from <codename>-proposed
sudo tee /etc/apt/preferences.d/azure-proxy-agent <<EOF
Package: azure-proxy-agent
Pin: release n=${CODENAME}-proposed
Pin-Priority: 501
EOF

# Add -proposed for this codename, install, then remove it
sudo add-apt-repository "deb http://archive.ubuntu.com/ubuntu ${CODENAME}-proposed main universe"
sudo apt update
sudo apt install azure-proxy-agent
sudo add-apt-repository -r "deb http://archive.ubuntu.com/ubuntu ${CODENAME}-proposed main universe"
```

## Install on Ubuntu 25.10 (development series)

```
sudo apt update
sudo apt install azure-proxy-agent

After installation, enable MSP on the VM/VMSS from Azure (Portal/CLI/template). Without enabling MSP, requests won’t be validated and protection won’t apply.
```

## Evaluation best practices

Every environment is different. If you decide to try MSP, start in Audit to observe behavior, and move to Enforce when you’re satisfied. Many teams simply sanity-check normal workloads and—if relevant—try a basic allowlist. Beyond that, test whatever reflects your risk model.

## Share your feedback

Please share results (Ubuntu release, kernel, VM size, architecture; any observations) in our [Discourse thread](https://discourse.ubuntu.com/t/ubuntu-on-azure-metadata-security-protocol-msp/68388). Your input will help us complete SRU validation and promote azure-proxy-agent to -updates for LTS users.

[Get in touch

Interested in running Ubuntu in your organization?](https://ubuntu.com/about/contact-us/form)

## Sign up for our newsletter

Get the latest Canonical news and updates in your inbox.

Work email:

\*I agree to receive information about Canonical's
products and services.

In submitting this form, I confirm that I have read and agree to
[Canonical's Privacy Notice](https://canonical.com/legal/data-privacy/contact)
and [Privacy Policy](https://canonical.com/legal/data-privacy).

Sign up

## Share on

---

## Related posts

[### AI infrastructure for telcos](https://canonical.com/blog/ai-infrastructure-for-telcos)

Why moving from pilots to production changes the platform Artificial intelligence has moved beyond the demonstration phase. Telco operators are already exploring it for fault...

[Benjamin Ryzman](https://canonical.com/blog/author/benjaminryzman)

2 October 2026

[### Canonical named a Challenger in the 2026 GartnerⓇ Magic Quadrant™ for Server Virtualization Platforms](https://canonical.com/blog/canonical-a-challenger-in-2026-gartner-magic-quadrant-for-server-virtualization-platforms)

Canonical has been recognized as a Challenger in the 2026 GartnerⓇ Magic Quadrant™ for Server Virtualization Platforms. The inaugural edition of the report provides an...

[Canonical](https://canonical.com/blog/author/canonical)

1 October 2026

[### Canonical announces the alpha release of Charmed OpenShell to help secure autonomous AI agent fleets](https://canonical.com/blog/charmed-openshell-alpha-release)

To streamline enterprise deployment and lifecycle management, Canonical is announcing the alpha release of Charmed OpenShell.

[Canonical](https://canonical.com/blog/author/canonical)

28 September 2026

[### Ubuntu coming soon to Snapdragon X2 Series platforms, unlocking more Linux PCs for the agentic world](https://canonical.com/blog/ubuntu-coming-soon-to-qualcomm-snapdragon-x2-series-platforms)

Canonical and Qualcomm Technologies announce upcoming native Ubuntu support for Qualcomm’s flagship laptop silicon, delivering multi-day battery life, 80 TOPS NPU acceleration,...

[Canonical](https://canonical.com/blog/author/canonical)

23 September 2026