JIT VM Access (Just-in-Time) in Microsoft Defender for Cloud Explained

JIT VM Access (Just-in-Time) in Microsoft Defender for Cloud Explained

Originally published 15 October 2020 · Reviewed 5 November 2026

Anything that listens for RDP or SSH on the public internet is scanned within minutes. Just-in-time (JIT) VM access reduces that exposure by keeping the management ports closed until a request is approved, then closing them again. The feature belongs to Microsoft Defender for Cloud, which was called Azure Security Center when most JIT tutorials were written. This article explains how it works, what you need and where it fits.

The problem

Attackers constantly probe virtual machines with open management ports, because a weak or reused password on RDP or SSH gives them a foothold inside your network. Administrators legitimately need those ports, so you cannot just remove them. The usual compromise is an allow rule for a trusted address range, which is hard to keep accurate for people who work from different places.

How JIT works

You enable JIT for a virtual machine and choose the ports to protect, for example 3389, 22, 5985 and 5986. Defender for Cloud then makes sure deny-all inbound rules exist for those ports, in the network security group (NSG) attached to the VM or its subnet and, where used, in Azure Firewall. If other rules already exist for the same ports, Microsoft documents that the existing rules keep their priority, so check your NSG for permanent allow rules that defeat JIT.

When someone needs access they make a request, choosing the VM, the ports, the source IP address or range and the duration. Defender for Cloud checks that the requester has the Azure RBAC permissions needed for that VM. If they do, it adds a temporary allow rule at a higher priority than the deny rule, limited to the requested source and ports. When the time ends, the rule is removed and the port closes again. Each request is logged, so you can see who asked for what and when.

What you need

• Defender for Cloud with the Defender for Servers plan. JIT is a paid Defender for Cloud capability; check the current plan requirements and prices before you rely on it.
• Network controls that support it. An NSG, and optionally Azure Firewall, on the VM's network path.
• RBAC permissions for the people who request access, which you grant with a role that allows initiating JIT requests on the target VMs. Grant it narrowly.
• Connectivity. JIT does not provide a tunnel; users still connect over the network using RDP or SSH to the VM's address.

Where JIT fits among the alternatives

• Azure Bastion gives browser-based RDP and SSH over TLS without exposing the VM's ports or giving it a public IP. It is often the better design for new deployments.
• A VPN or private connection puts administrators on the private network, so the ports are never public.
• Removing public IPs altogether is the strongest posture, with administration through private paths.
• JIT suits cases where a VM must keep a public IP, for example in a lift-and-shift, and you want tighter control quickly.

These options combine well. A private-only design with Bastion, plus JIT for the VMs that must remain reachable, covers most cases.

Rolling it out

1. Find exposed VMs. Defender for Cloud and the NSG rules show which VMs allow management ports from the internet.
2. Enable JIT on those VMs first, starting with a non-production machine to learn the workflow.
3. Review existing NSG rules. Remove permanent allow rules for the protected ports, or JIT will not close them.
4. Define who can request access, the maximum duration, and whether any source address is allowed. Prefer a specific address range over "any".
5. Teach the team the request process, including how to request from the portal or the command line.
6. Alert on requests that come from unusual people, hours or locations.

Limits and cautions

JIT does not protect a VM once access is granted: a stolen credential during the open window still works. Combine it with strong authentication, such as MFA or certificate-based SSH, and keep operating systems patched. It controls network access for specific ports only; it does not manage application ports or outbound traffic. Test what happens if Defender for Cloud is unavailable, so that you know whether ports fail closed.

What to monitor

Treat JIT requests as a security log, not just a convenience. Look at who requested access, from which address, for which port and how long. A request at an unusual hour, from an unfamiliar address range, or for every VM at once deserves a question. Check that no permanent allow rules appear in the network security groups after the feature is enabled, since someone may add one to fix an urgent problem and forget it. Review the list of protected VMs each quarter, and add new VMs as they are built, because a machine created after the rollout does not protect itself.

Microsoft references

• Understand just-in-time (JIT) VM access, reviewed 5 November 2026.
• Secure management ports with just-in-time access, reviewed 5 November 2026.

This article was first published on 15 October 2020. It was rewritten on 5 November 2026 with the current product name. Microsoft's live documentation takes precedence if it has changed.