Azure Bastion and Just-In-Time (JIT) VM Access are two core services for securing remote connections to Azure virtual machines. They work together to enforce the principle of least privilege by eliminating the need for persistent, publicly exposed management ports. Azure Bastion provides a managed, browser-based gateway for SSH and RDP sessions, while JIT VM Access enables administrators to open specific VM ports only for a limited, approved time window.
Azure Bastion is deployed as a dedicated service instance into your virtual network. It requires a dedicated subnet named AzureBastionSubnet with a minimum address prefix of /26. When you deploy Bastion, you choose a Standard or higher SKU, which provisions the service into your network. The key security benefit is that target VMs do not need public IP addresses; all connection traffic flows over the private Azure backbone. Users connect by navigating to the VM in the Azure portal and selecting Connect > Bastion, which opens a secure RDP or SSH session directly in their web browser.
The Bastion service depends on specific network rules to function correctly and securely. You must configure Network Security Groups (NSGs) attached to the AzureBastionSubnet to allow required traffic. Ingress rules must permit port 443 (HTTPS) from the Internet for user browser connections, as well as from the GatewayManager and AzureLoadBalancer service tags for Azure's internal management. Egress rules must allow traffic from Bastion to target VMs on ports 3389 (RDP) and 22 (SSH), to ports 8080 and 5701 for Bastion's internal data plane, and to port 443 for the AzureCloud service tag for updates. Omitting these rules can break the service or create security vulnerabilities.
Just-In-Time (JIT) VM Access is configured through policies in Microsoft Defender for Cloud. A JIT policy defines the conditions for temporary access to a VM. You specify which ports (like 3389 or 22), which protocols (TCP or UDP), and which source IP address ranges are allowed. When access is needed, an authorized user requests it, and the policy grants inbound access for a pre-defined maximum time window, such as one hour. This drastically reduces the VM's attack surface by keeping management ports closed at all other times.
Both services integrate tightly with Azure's identity and governance tools. JIT VM Access uses Role-Based Access Control (RBAC) to determine which users have permission to request or approve access. All activities—including Bastion connection sessions and JIT access requests, approvals, and activations—are logged to Azure Monitor. This creates a comprehensive audit trail that is essential for security investigations and meeting compliance requirements, as it records who accessed which resource, when, and from where.
Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Prepare and test your skills
Prepare and test your skills
Azure Bastion provides a managed, browser-based gateway for SSH and RDP sessions, eliminating the need for public IPs on target VMs, while Just-In-Time (JIT) VM Access opens specific VM ports only for a limited, approved time window to reduce the attack surface. Both enforce least privilege but in different ways: Bastion handles the connection channel, and JIT controls port exposure.
Azure Bastion requires a dedicated subnet named AzureBastionSubnet with a minimum address prefix of /26. This subnet must be created in the virtual network where Bastion is deployed.
Just-In-Time (JIT) VM Access uses Role-Based Access Control (RBAC) to determine which users can request or approve access. All JIT access requests, approvals, and activations are logged to Azure Monitor, creating a comprehensive audit trail.
StudyCerts
StudyCerts