Agent Foskett Academy • Microsoft Defender for Cloud • Module 3 • Lesson 21

Lesson 21 — Just-In-Time VM Access

Just-In-Time VM Access reduces the network exposure of Azure virtual machines by keeping management ports closed until an authorised user requests temporary access.

Instead of leaving RDP, SSH or another administrative port continuously reachable, Microsoft Defender for Cloud applies a controlled access policy that defines the permitted ports, source addresses and maximum connection duration. When access is approved, the required network rule is opened temporarily and then restricted again when the approved period expires.

This lesson explains how JIT policies work, the relationship between Defender for Cloud and network controls, supported access paths, role permissions, request auditing, operational validation, troubleshooting and the security checks needed to prove that management ports are not being left unnecessarily exposed.

JIT does not replace secure administration. It reduces the time and source range through which a protected management port can be reached.

Start Lesson Back to Defender for Cloud Academy

Agent Foskett Just-In-Time VM Access lesson

What you will learn

This lesson shows how JIT converts permanently exposed management ports into temporary, controlled and auditable access.

JIT policy design

Temporary access requests

NSG and firewall controls

Auditing and troubleshooting

Just-In-Time VM Access workflow

Azure virtual machine requires administrative access ↓ JIT policy defines protected ports and maximum duration ↓ Inbound management access remains restricted ↓ Authorised administrator requests access ↓ Source IP, port and duration are evaluated ↓ Temporary network access rule is applied ↓ Administrator connects to the virtual machine ↓ Approved duration expires ↓ Temporary access is removed ↓ Management port returns to its protected state

JIT access components

Component	Purpose	Operational check
JIT policy	Defines which management ports are protected, permitted source ranges and maximum access duration.	Policy matches the server's administration requirements.
Network Security Group	Controls inbound traffic at the subnet or network-interface level.	JIT rules are applied at the correct effective scope.
Azure Firewall	Can participate in supported JIT network-access scenarios.	Routing and firewall rules permit the approved path.
Azure RBAC	Controls who can configure JIT policies and request access.	Permissions follow least privilege.
Activity and request history	Records configuration and access-request activity.	Logs are retained, reviewed and connected to monitoring.

Learning objectives

After completing this lesson, you should be able to explain, configure, request and validate Just-In-Time VM Access.

Explain the purpose of JIT.
Identify exposed management ports.
Describe policy settings.
Understand temporary rule changes.
Review permissions and audit activity.
Troubleshoot failed access requests.

What is Just-In-Time VM Access?

Just-In-Time VM Access is a Microsoft Defender for Cloud capability that limits inbound access to protected Azure virtual machines.

Access is opened only for an approved port, source address and period of time.

The exposure problem

Publicly reachable RDP, SSH and other administration services are continuously scanned and attacked.

Even strong credentials do not remove the risk created by an unnecessarily exposed service.

Common management ports

RDP — TCP 3389
SSH — TCP 22
WinRM HTTP — TCP 5985
WinRM HTTPS — TCP 5986
Approved custom TCP or UDP ports

JIT is not authentication

JIT controls whether network traffic can reach a management service.

The administrator must still authenticate to the operating system using an approved identity and secure authentication method.

JIT is not privileged access management

JIT network access should be combined with Microsoft Entra controls, privileged role management, MFA, endpoint security and administrative monitoring.

Eligibility

A virtual machine must have a supported network-control path before Defender for Cloud can apply JIT protection.

Security teams should validate the effective NSG, firewall and routing design rather than assuming every VM is eligible.

Policy scope

JIT is configured for selected virtual machines.

Each VM should be assessed according to exposure, business criticality, administration method and operational need.

Protected ports

The policy lists the ports that require controlled access.

Only ports genuinely required for administration should be included.

Protocol selection

Policies can specify the required transport protocol where supported.

Protocol and port values must match the actual management service.

Allowed source addresses

Access should be restricted to the administrator's current public IP or another approved source range.

Broad source ranges reduce the security value of JIT.

Maximum access duration

The policy defines the longest period for which a port can remain available after approval.

Use the shortest duration that supports the maintenance task.

Requesting access

An authorised administrator selects the VM, port, source address and requested duration.

The request must remain within the limits defined by the JIT policy.

Temporary network rule

When access is granted, Defender for Cloud updates the supported network control to permit the approved connection.

The rule is narrowly scoped to the requested source, port and time window.

Access expiry

When the access period ends, the temporary allowance is removed or becomes ineffective.

Operations should verify that ports return to the expected restricted state.

Network Security Groups

JIT commonly works with effective NSG rules applied to a virtual machine's network interface or subnet.

Conflicting or higher-priority rules can change the expected result.

Effective security rules

Review effective rules, not only the NSG object closest to the VM.

Subnet rules, network-interface rules and other network controls can combine to permit or block traffic.

Azure Firewall paths

Where traffic passes through Azure Firewall, routing and firewall configuration must support the approved management path.

JIT cannot compensate for an incorrectly designed route.

Public IP exposure

JIT reduces exposure but does not remove the public IP from the VM.

Organisations should still evaluate Azure Bastion, VPN, private administration paths and removal of unnecessary public endpoints.

Azure Bastion

Azure Bastion can provide browser-based RDP and SSH without exposing those ports directly to the public internet.

JIT and Bastion solve related but different access-control problems and should be assessed as part of the overall administration design.

Role-based access control

Only approved identities should be able to configure JIT policies or request access.

Separate configuration authority from routine access where practical.

Least privilege

Users should receive only the Azure permissions and operating-system privileges needed for their role.

JIT access to a port should never imply unrestricted administrator rights inside the VM.

Multi-factor authentication

Use MFA and strong identity controls for administrators who can request or use JIT access.

Network restrictions and identity protection should reinforce each other.

Privileged workstations

Administrative access should originate from managed, monitored and hardened devices.

Allowing a compromised endpoint through JIT can still expose the server.

Request history

Review who requested access, which VM and port were selected, the source address, requested duration and outcome.

Azure activity logging

Configuration changes and access activity should be retained in the organisation's monitoring and audit process.

Important events can be exported for central investigation and reporting.

Suspicious request patterns

Requests outside normal support hours
Unfamiliar source addresses
Repeated requests for long durations
Access to high-value production systems
Multiple denied or failed attempts
Requests from newly privileged identities

Operational ownership

Every JIT-enabled VM should have a technical owner and a documented administration method.

Security teams should know who approves exceptions and who investigates unexpected access.

Emergency access

Emergency procedures should be documented and tested without creating permanently open management ports.

Break-glass access must remain tightly controlled, monitored and reviewed.

Common configuration failure

A JIT policy can appear configured while another effective network rule still permits broad inbound access.

Always test the VM from an unauthorised source.

Common request failure

Access can fail because of missing RBAC permissions, incorrect source IP, routing, NSG priority, Azure Firewall rules, guest firewall settings or a stopped management service.

Guest operating-system firewall

JIT changes the Azure network path but does not automatically repair a blocked Windows Firewall or Linux firewall rule inside the VM.

Source IP accuracy

Administrators behind proxies, VPNs or changing internet connections must request access from the public source address that reaches Azure.

Time synchronisation

Accurate time supports reliable auditing and troubleshooting across Azure logs, endpoint events and administrative records.

JIT validation checklist

Check	Expected result	Evidence
Before request	Protected management port is unreachable from an unauthorised source.	Connection test and effective network rules.
During request	Only the approved source can reach the selected port.	Temporary rule and successful authorised connection.
After expiry	The temporary path is no longer available.	Connection test and rule review.
Identity	Only approved roles can request access.	RBAC assignment and denied-access testing.
Audit	Request details are retained and searchable.	Request history and activity logs.

Agent Foskett investigation: “The attacker never reached the login screen…”

An Azure VM had previously exposed RDP to the internet ↓ The server received continuous password attempts ↓ Operations enabled Just-In-Time VM Access ↓ RDP was restricted outside approved access windows ↓ Internet scanning continued ↓ But the management port no longer responded ↓ A support engineer later requested one hour of access ↓ The request used the engineer's current public IP ↓ A temporary inbound rule was created ↓ The engineer completed maintenance ↓ The approved period expired ↓ RDP became unreachable again ↓ Agent Foskett reviewed the request history ↓ The user, source address, port and duration matched the change record ↓ No unauthorised source reached the login service ↓ The attack was stopped before authentication began

The strongest failed login is the one an attacker never gets the opportunity to attempt.

Key takeaways

Just-In-Time VM Access reduces unnecessary exposure of Azure VM management ports.
Policies define permitted ports, sources and maximum duration.
JIT controls network reachability; it does not replace authentication or endpoint protection.
Effective NSG, firewall and routing rules must be validated.
Access should originate from approved source addresses and hardened administrator devices.
RBAC must restrict who can configure policies and request access.
Temporary access should use the shortest practical duration.
Request history and Azure activity should be reviewed centrally.
Testing before, during and after access proves that JIT is working.
Private administration paths such as Azure Bastion or VPN should still be considered.

What Agent Foskett checked

VM eligibility
JIT policy settings
Protected ports
Allowed source range
Maximum duration
Effective NSG rules
Azure Firewall path
Guest firewall
RBAC permissions
Request history
Access expiry
Unauthorised connection testing

Best practices

Remove permanently open management rules.
Use narrow source IP ranges.
Keep access windows short.
Require MFA for administrators.
Use hardened admin workstations.
Review high-value VM requests.
Export audit activity.
Test expiry behaviour.
Document emergency access.
Prefer private management paths where practical.

Related Agent Foskett resources

Continue building Microsoft Defender for Cloud server, network and workload-protection skills.

Microsoft Defender for Cloud Academy Lesson 21 — Just-In-Time VM Access Lesson 20 — Operationalising Microsoft Defender for Cloud Microsoft Defender for Endpoint Academy Microsoft Sentinel Academy Agent Foskett Academy Microsoft Security Services

Continue learning

Continue Module 3 by learning how Microsoft Defender for Storage detects suspicious access, malicious files and storage-account threats.

⬅ Previous lesson

Lesson 20 — Operationalising Microsoft Defender for CloudReview daily operations, governance, automation, reporting and continuous cloud security improvement.

🏠 Academy home

Microsoft Defender for Cloud AcademyReview the complete roadmap across posture, workloads, compliance and investigation.

📘 Next lesson

Lesson 22 — Defender for StorageLearn how Microsoft Defender for Storage protects storage accounts against suspicious access, malware and data threats.

What is Just-In-Time VM Access?

Just-In-Time VM Access is a Microsoft Defender for Cloud capability that reduces Azure virtual machine exposure by restricting inbound management ports until approved temporary access is requested.

Just-In-Time VM Access Lesson

This Agent Foskett lesson explains JIT policy design, protected ports, temporary access requests, Network Security Groups, Azure Firewall paths, Azure RBAC, auditing, validation and troubleshooting.