Just-in-Time (JIT) VM Access is a security feature from Microsoft Defender for Cloud that reduces the attack surface of your virtual machines. It works by keeping management ports, like RDP (3389) and SSH (22), closed by default. An administrator must request access, which opens these ports only for a specific IP address and for a limited time window. You configure JIT by selecting target VMs and defining rules that specify which ports can be opened, which source IP ranges are allowed to request access, and the maximum time access can be granted.
After JIT is enabled, you can manage its rules. You can add new ports to the policy, modify the list of approved source IP addresses, or adjust the maximum request duration. When a user needs access, they submit a request through the Defender for Cloud portal, selecting the VM, port, their source IP, and a time period within the policy's limits. The port opens only if the request matches all the configured rules, providing precise, temporary access.
Azure Bastion is a fully managed PaaS service that provides secure RDP and SSH connectivity to your VMs without exposing them to the public internet. You connect to a VM through your web browser via the Azure portal, and the traffic flows securely over TLS on port 443. To deploy Bastion, you must first create a dedicated subnet in your virtual network with the specific name AzureBastionSubnet. You then deploy the Bastion resource into this subnet using the Azure portal, CLI, or PowerShell.
Because Azure Bastion provides the secure tunnel, your VMs do not need public IP addresses. However, you must configure Network Security Group (NSG) rules to ensure only traffic from the Bastion service can reach your VMs' management ports. This typically involves allowing inbound traffic on ports 3389 (RDP) or 22 (SSH) from the IP range of the AzureBastionSubnet or from the Azure Bastion service tag. This setup creates a clear trust boundary: all administrative traffic must flow through the managed Bastion service, which sits in its own dedicated subnet.
Using JIT and Azure Bastion together creates a layered security model. You can configure your JIT policy to only allow access requests originating from the IP range used by your Azure Bastion service. This means an administrator must first get JIT approval, which temporarily opens the port, and then they must connect through the Bastion host. This combination enforces that access is both time-limited and channeled through a secure, managed service, validating connectivity without any public IP exposure on the VMs themselves.
Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Prepare and test your skills
Prepare and test your skills
Just-in-Time (JIT) VM Access is a security feature that reduces the attack surface by keeping management ports like RDP (3389) and SSH (22) closed by default, opening them only for a specific IP address and for a limited time upon an approved administrator request.
To deploy Azure Bastion, you must first create a dedicated subnet in your virtual network with the specific name AzureBastionSubnet, and then deploy the Bastion resource into this subnet using the Azure portal, CLI, or PowerShell.
Using JIT and Azure Bastion together creates a layered security model where JIT policy can be configured to only allow access requests from the Azure Bastion service IP range, ensuring access is both time-limited and channeled through the secure, managed Bastion service without public IP exposure on the VMs.
StudyCerts
StudyCerts