Protect your resources with JIT VM access
Management ports such as Remote Desktop Protocol (RDP), Secure Shell (SSH), and Windows Remote Management (WinRM) are common targets for attackers. If these ports are open for long periods, threat actors can discover them through scanning and attempt brute-force or exploitation attacks.
Microsoft Defender for Cloud includes just-in-time (JIT) VM access with Defender for Servers Plan 2. JIT VM access helps reduce exposure by closing selected management ports by default and opening them only when an approved user requests access for a specific source IP address and time window.
How JIT VM access works
When you enable JIT VM access for an Azure VM, Defender for Cloud configures network security group (NSG) and Azure Firewall rules to block inbound traffic on the ports that you select. When a user requests access, Defender for Cloud checks whether the user has the required Azure role-based access control (Azure RBAC) permissions. If the request is approved, Defender for Cloud temporarily updates the NSG or Azure Firewall rules to allow inbound traffic from the requested source IP address or range.
After the approved time expires, Defender for Cloud restores the previous rules and closes the ports again. Existing connections aren’t interrupted when the time window expires, but new connection attempts are blocked unless a new request is approved.
JIT VM access can protect supported Azure VMs and supported AWS EC2 instances connected to Defender for Cloud. For Azure VMs, the VM must be deployed through Azure Resource Manager and protected by an NSG, Azure Firewall, or both. JIT doesn’t support classic VMs, VMs protected by Azure Firewall Manager-controlled firewalls, or Azure Firewall policies.