Add Azure.Fleet.PublicKey rule for Linux Azure Fleet VM profiles (AZR-000541)

[Copilot]

Adds Azure.Fleet.PublicKey (AZR-000535) — a new security rule for Microsoft.AzureFleet/fleets that enforces SSH key-based authentication on Linux fleet VM profiles, analogous to the existing Azure.VMSS.PublicKey rule.

Rule logic

• Introduces FleetHasLinuxOS helper (mirrors VMSSHasLinuxOS) — detects Linux via osType, presence of linuxConfiguration, or image reference publisher/offer
• Rule only fires on Linux fleet profiles; Windows fleets yield None
• Checks properties.computeProfile.baseVirtualMachineProfile.osProfile.linuxConfiguration.disablePasswordAuthentication is true

resource linux_fleet 'Microsoft.AzureFleet/fleets@2024-11-01' = {
  properties: {
    computeProfile: {
      baseVirtualMachineProfile: {
        osProfile: {
          linuxConfiguration: {
            disablePasswordAuthentication: true  // required to pass
            ssh: { publicKeys: [...] }
          }
        }
      }
    }
  }
}

Changes

• Azure.Common.Rule.ps1 — adds FleetHasLinuxOS function
• Azure.Fleet.Rule.ps1 — new rule file with Azure.Fleet.PublicKey (ruleSet 2026_06, label Azure.MCSB.v1/control: DP-4)
• PSRule-rules.psd1 — adds FleetPublicKey localized reason string
• docs/en/rules/Azure.Fleet.PublicKey.md — rule documentation with ARM template and Bicep examples
• docs/examples/resources/fleet.bicep — adds compliant Linux fleet example
• Resources.Fleet.json / Azure.Fleet.Tests.ps1 — test data covering pass (SSH key auth), fail (password enabled, missing property), and skip (Windows)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[RULE] Check for public key usage on Linux fleet VM profiles</issue_title>
<issue_description>### Existing rule

Azure.VM.PublicKey

Suggested rule

Add support for Microsoft.AzureFleet/fleets with a new rule similar to Azure.VM.PublicKey.

Pillar

Security

Additional context

https://learn.microsoft.com/en-us/azure/templates/microsoft.azurefleet/fleets?pivots=deployment-language-bicep</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [RULE] Check for public key usage on Linux fleet VM profiles #3343

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.