moritzheiber/himmelblau

Himmelblau lets people sign in to Linux computers using their Microsoft Azure Entra ID (formerly Azure AD) accounts, the same work accounts they already use for Microsoft 365 and other corporate services. It also enrolls Linux machines into Microsoft Intune, so IT teams can check that those devices meet company security policies before granting access. Under the hood, the project plugs into the standard Linux login system (the modules that handle authentication and user lookups) and bridges those to Microsoft's cloud identity service. A background service talks to Entra ID to verify credentials, handle multi-factor authentication, and confirm device compliance. The result is that a Linux machine can behave much like a Windows or Mac that's been joined to a corporate network, users log in with their organizational identity, and IT can manage access centrally. The primary audience is IT departments running mixed environments where some machines are Linux but the corporate identity system is Microsoft-based. For example, a company might have developers using Linux workstations or a fleet of Linux servers, but everyone's accounts and group memberships live in Entra ID. Without a tool like this, IT would have to maintain a separate identity system just for Linux or fall back to local accounts that are hard to audit and manage. The project is primarily developed and sponsored by SUSE, a major Linux enterprise company, and is available across a wide range of distributions including openSUSE, Ubuntu, Debian, Fedora, RHEL/Rocky, and NixOS. Installation is done through native package managers for each distro. Configuration requires editing a config file and adjusting Linux's authentication stack, so it's an IT-administrator-level task rather than something an end user would set up themselves. One notable capability is support for multi-factor authentication over SSH, meaning someone connecting to a remote Linux server can be prompted for a second factor through the same Entra ID flow they use elsewhere. The project also supports single sign-on integrations for browsers and offers an optional package that provides access to the Office 365 suite on Linux.