Just-In-Time (JIT) VM Access

Just-In-Time (JIT) VM Access is a feature of Microsoft Defender for Cloud that provides on-demand, time-limited access to Azure virtual machines. Its primary purpose is to reduce the attack surface by blocking inbound traffic to management ports (RDP port 3389, SSH port 22) except when explicitly requested and approved. Instead of leaving these ports open continuously — which invites brute-force attacks — JIT opens them only for a specific user, source IP, and duration.

Traditional network security groups (NSGs) or Azure Firewall rules allow you to restrict access to management ports, but often administrators open them broadly (e.g., 0.0.0.0/0) for convenience. This creates a persistent vulnerability. JIT solves this by enforcing a "zero standing access" model: no permanent rules allow RDP/SSH from the internet. Access is granted dynamically based on user requests that are logged and audited.

JIT operates through a combination of Azure Policy, NSG rules, and Defender for Cloud. Here is the step-by-step mechanism:

- The VM(s) - The port (3389 or 22) - The source IP address (or * for any) - The duration (1-3 hours by default, configurable)

Enable JIT via PowerShell:

$JitPolicy = (@{
    id = "/subscriptions/<subscription-id>/resourceGroups/<rg>/providers/Microsoft.Compute/virtualMachines/<vm-name>"
    ports = (@{
        number = 22
        protocol = "tcp"
        allowedSourceAddressPrefix = "*"
        maxRequestAccessDuration = "PT3H"
    })
})
Set-AzJitNetworkAccessPolicy -ResourceGroupName <rg> -Location <location> -Name "default" -VirtualMachine $JitPolicy

Request access via CLI:

az vm jit-access request --resource-group <rg> --name <vm-name> --port 22 --source-ip <your-ip> --duration 1h

Verify JIT status via CLI:

az vm jit-access list --resource-group <rg>

Check NSG rules:

Get-AzNetworkSecurityGroup -Name <nsg-name> -ResourceGroupName <rg> | Get-AzNetworkSecurityRuleConfig | Where-Object {$_.Name -like "*JIT*"}

JIT integrates with: - Azure Policy: You can enforce JIT on all VMs in a subscription using built-in initiative 'Enable JIT network access control on virtual machines'. - Azure Bastion: JIT and Bastion are complementary. Bastion provides secure RDP/SSH via the Azure portal over TLS, while JIT controls NSG-level access. They can be used together: Bastion traffic is allowed by default, but JIT can still protect management ports from direct internet exposure. - Azure Firewall: When VMs are behind Azure Firewall, JIT uses Firewall NAT rules instead of NSG rules. - Log Analytics: JIT logs can be sent to Log Analytics for monitoring and alerting. - Conditional Access: You can require multi-factor authentication (MFA) for JIT requests via Azure AD Conditional Access policies applied to the Azure Management app.

A multinational corporation has hundreds of Azure VMs across multiple regions. Their IT administrators need to occasionally RDP into VMs for patching and troubleshooting. Previously, they left RDP open to the internet, leading to constant brute-force attacks. They deployed JIT via Azure Policy, enforcing it on all VMs. Administrators now request access through a custom portal that integrates with Azure AD Conditional Access, requiring MFA. The JIT duration is set to 2 hours by default. This reduced the attack surface dramatically; the NSG deny rules block all inbound RDP except when explicitly requested. Performance is negligible because NSG rules are evaluated at the Azure backbone level. Misconfiguration: if the NSG is detached from the VM, JIT cannot enforce access, leaving the VM exposed. They now use Azure Policy to prevent detachment.

A financial services company must comply with PCI DSS requirement 7.2.1, which mandates least-privilege access. They use JIT to ensure that administrative access to payment processing VMs is time-boxed and audited. They configure JIT with a maximum duration of 1 hour and require approval from a security manager via Privileged Identity Management (PIM). All JIT requests are logged to Azure Monitor and sent to their SIEM for real-time alerting. They also use Azure Firewall for additional network segmentation; JIT creates NAT rules on the firewall. One challenge: if the firewall policy has a rule that denies all traffic by default, the JIT NAT rule must be correctly prioritized. They set the firewall rule priority to 100 for the JIT allow rule, ensuring it overrides the default deny. Without this, access would fail even with a valid JIT request.

A SaaS company allows third-party vendors to access specific VMs for support. They use JIT to grant time-limited access only from the vendor's public IP. The JIT request is automated via a webhook that triggers a PowerShell script. The vendor's IP changes occasionally, so they use a dynamic DNS name that resolves to the vendor's current IP. The JIT request specifies the resolved IP. This ensures that even if the vendor's IP changes, they can still request access. However, if the DNS resolution is stale, the request may fail. They mitigate by using a short TTL on the DNS record. This scenario demonstrates JIT's flexibility in non-standard environments.