The Guest Proxy Agent hardens access to Azure’s Instance Metadata Service and Wireserver endpoints from inside a virtual machine. It identifies the calling process and checks it against an allow list. Authorised requests receive an HMAC signature header, so the metadata service can reject unauthenticated requests. It runs on Windows and Linux guests and uses eBPF to intercept only metadata traffic.