How to Reset Root Password on a Linux VM in Azure (4 Methods That Work)

If you forgot the root password on your Azure Linux VM, you have four ways to recover access. The right method depends on whether the Azure Linux Agent (waagent) is running on your VM and whether the VM is still booting.

This guide walks you through every method, from the fastest portal reset to the last-resort disk repair approach. Pick the one that matches your situation using the table below.

Quick Reference: Which Method Should You Use?

Method 1: Reset Root Password on Linux VM via Azure Portal (Fastest, No Downtime)

The Azure Portal method requires no VM downtime and no SSH access. It uses the VMAccess Extension to push the new credentials directly to the VM through the Azure Linux Agent.

Requirements: The Azure Linux Agent (waagent) must be installed and in a Ready state on the VM.

Steps:

1. Open the Azure Portal and go to Virtual Machines.
2. Select your VM from the list.
3. In the left menu, scroll to Help and click Reset password.
4. Select Reset password as the mode.
5. Enter your username (for example, root or your admin user) and type a new password.
6. Click Update.

Once the update completes, try to connect to your VM over SSH with the new password.

Tip: If you also need to update your SSH key instead of the password, use the Reset SSH public key mode on the same Reset password screen.

Method 2: Reset Password via the Azure CLI

If you prefer command-line tools, the Azure CLI method produces the same result as the portal reset. Open Azure Cloud Shell or your local terminal and run the following commands:

AZ_RESOURCE_GROUP="YourResourceGroupName"
AZ_VM_NAME="YourVMName"
AZ_ADMIN_USER="adminName"
AZ_MSADMIN_PASS="NewPassword123!"

az vm user update \
  -u $AZ_ADMIN_USER \
  -p $AZ_MSADMIN_PASS \
  -g $AZ_RESOURCE_GROUP \
  -n $AZ_VM_NAME

This command uses the VMAccess Extension under the hood, so the Azure Linux Agent must be healthy and responsive for it to work.

After the command completes, test your SSH connection with the new password.

Method 3: Reset Password via Serial Console and Single-User Mode

The Serial Console connects directly to the VM’s serial port, independent of SSH or the network. This method works even when waagent is unresponsive, because you bypass the guest agent entirely and interact with GRUB directly.

Step 1: Open the Serial Console

1. In the Azure Portal, navigate to your VM.
2. Under the Help section, click Serial console.
3. Wait for the console to connect and display a login prompt or shell.

Step 2: Reboot and Enter GRUB

In the Serial Console, reboot the VM. When the GRUB menu appears, press E to edit the boot entry.

For Ubuntu and Debian:

1. Find the line that starts with linux.
2. Append single to the end of that line.
3. Press Ctrl+X to boot with those settings.

For RHEL, CentOS, and Oracle Linux:

1. Find the linux or linux16 line.
2. Append rd.break to the end of that line.
3. Press Ctrl+X to boot.

For SUSE SLES:

1. Find the linux line.
2. Append systemd.unit=emergency.target to the end.
3. Press Ctrl+X to enter the emergency shell.

Step 3: Remount the Filesystem and Set a New Password

Once you land in the single-user or emergency shell, remount the filesystem with read-write permissions and run passwd.

Ubuntu / Debian:

mount -o remount,rw /
passwd root
/usr/sbin/reboot -f

RHEL / CentOS / Oracle Linux:

mount -o remount,rw /sysroot
chroot /sysroot
passwd root
touch /.autorelabel
exit
/usr/sbin/reboot -f

SELinux Note: If SELinux is in enforcing mode, run touch /.autorelabel before rebooting. This triggers a filesystem relabeling on the next boot and prevents SELinux from blocking the password change.

SUSE SLES:

mount -o remount,rw /
passwd root
/usr/sbin/reboot -f

Step 4: Verify SSH Password Authentication is Enabled

After the VM reboots, check that password authentication is active in the SSH config:

egrep "^PasswordAuthentication" /etc/ssh/sshd_config

If the output shows PasswordAuthentication no, open the file with vi or nano and change the value to yes. Then restart the SSH daemon:

systemctl restart sshd

Now try to connect over SSH with your new password. Because compromised SSH credentials are one of the most common attack vectors on internet-facing Linux servers (see how the New Linux Botnet “SSHStalker” hijacked nearly 7,000 servers using exactly this kind of exposure), consider disabling password authentication again after recovery and switching to SSH key-based authentication.

Method 4: Reset Password via OS Disk Repair VM (Last Resort)

If the VM will not boot at all and the Serial Console is inaccessible, you need to detach the OS disk, attach it to a healthy repair VM, change the password inside a chroot environment, then reattach the disk.

Step 1: Create the Repair VM

Run the following az vm repair create command to create a repair VM with a copy of the affected VM’s OS disk automatically attached:

AZ_RESOURCE_GROUP="YourResourceGroupName"
AZ_VM_NAME="YourVMName"
AZ_ADMIN_USER="repairUser"
AZ_MSADMIN_PASS="RepairPassword123!"

az vm repair create \
  -g $AZ_RESOURCE_GROUP \
  -n $AZ_VM_NAME \
  --repair-username $AZ_ADMIN_USER \
  --repair-password "$AZ_MSADMIN_PASS" \
  --verbose

Azure automatically attaches the copy of the OS disk to the repair VM once provisioning completes.

Step 2: Change the Password in the chroot Environment

1. Log in to the repair VM using the credentials you set above.
2. Enter the chroot environment where the affected OS disk is mounted.
3. Run the following command to set a new password:

passwd root

Or, for a named admin user:

passwd <username>

4. Check whether SELinux is in enforcing mode:

cat /etc/sysconfig/selinux

If it is, run touch /.autorelabel to schedule a relabel on the next boot.

5. Verify that PasswordAuthentication is set to yes in /etc/ssh/sshd_config. If not, change it with a text editor.
6. Exit the chroot environment.

Step 3: Restore the Original VM

Run the following command to reattach the OS disk to the original VM:

az vm repair restore \
  -g $AZ_RESOURCE_GROUP \
  -n $AZ_VM_NAME \
  --verbose

Start the VM and test SSH access with the new password.

Supported Linux Distributions for the VMAccess Extension

The portal and CLI methods (Method 1 and Method 2) rely on the VMAccess Extension. Microsoft supports the following Linux distributions and versions:

Frequently Asked Questions

Related Tech Guides

• Best CLI Tools for Linux to Install First on a New Machine
• New Linux Botnet “SSHStalker” Uses Old-School IRC to Hijack Nearly 7,000 Servers
• How to Fix “Error While Loading Shared Libraries: Cannot Open Shared Object File” in Linux