# How to Implement Just-In-Time (JIT) VM Access in Microsoft Defender for Cloud
Leaving management ports—such as RDP (3389) or SSH (22)—permanently open on internet-facing virtual machines is one of the most common causes of cloud security breaches. Automated brute-force attacks and port scanners constantly probe public IP addresses for these vulnerabilities.
While using a VPN or Azure Bastion is the preferred method for securing access, many organizations still require direct public access for specific legacy applications or third-party contractors.
To mitigate the risk in these scenarios, Microsoft provides **Just-In-Time (JIT) VM Access** through Microsoft Defender for Cloud.
JIT access operates on the principle of least privilege. It keeps inbound management ports completely locked down at the Network Security Group (NSG) level by default. When an authorized user requests access, JIT temporarily opens the specific port, only for their specific IP address, and only for a limited timeframe (e.g., 2 hours).
This guide explains how to enable and configure JIT VM Access in Azure.
## Prerequisites
To utilize JIT VM Access, you must have the following configured:
1. An active Azure subscription.
2. One or more Azure Virtual Machines.
3. **Microsoft Defender for Servers** must be enabled on the subscription or workspace level. (JIT is not available on the free tier of Defender for Cloud).
4. The user requesting access must have the `Contributor` or `Owner` role on the VM, or a custom role with `Microsoft.Security/locations/jitNetworkAccessPolicies/initiate/action` permissions.
## Step 1: Enable Microsoft Defender for Servers
If you have not already enabled the paid tier of Defender for Cloud, you must do so first.
1. Navigate to **Microsoft Defender for Cloud** in the Azure Portal.
2. In the left menu, select **Environment settings**.
3. Select the subscription containing your VMs.
4. Under the **Defender plans** tab, ensure the **Servers** plan is toggled to **On**.
5. Click **Save** at the top of the screen.
## Step 2: Enable JIT Access on a Virtual Machine
Once Defender is active, you can apply JIT policies to your VMs.
1. In the Microsoft Defender for Cloud dashboard, scroll down the left menu and select **Workload protections**.
2. Under the Advanced protection section, click on **Just-in-time VM access**.
3. The interface displays three tabs: **Configured**, **Not configured**, and **Unsupported**. Click the **Not configured** tab.
4. You will see a list of VMs that are eligible for JIT but do not currently have it enabled. Check the box next to the VM you wish to protect.
5. Click the **Enable JIT on 1 VM** button.
## Step 3: Configure the JIT Port Rules
A configuration pane will slide out, displaying the default ports JIT will manage. By default, Azure recommends locking down port 22 (SSH), 3389 (RDP), 5985 (WinRM), and 5986 (WinRM HTTPS).
1. Click on port **3389** to edit its rule.
2. In the **Edit rule** pane, you define the boundaries of the access:
– **Protocol:** Any, TCP, or UDP. (Leave as Any or TCP).
– **Allowed source IPs:** Select **Per request**. This is the most secure option. It forces the user to specify their exact IP address when requesting access, preventing the port from being opened to the entire internet.
– **Max request time:** This dictates how long the port remains open before Azure automatically locks it again. The default is 3 hours. We recommend changing this to **1 or 2 hours** to enforce stricter security.
3. Click **OK**.
4. Repeat this process for the other default ports, or click the trash can icon to remove them if they are not relevant to your VM.
5. Click **Save** to apply the JIT policy.
Azure immediately modifies the Network Security Group (NSG) associated with the VM, creating a high-priority “Deny All” rule for the specified ports.
## Step 4: Requesting JIT Access
Now that the VM is locked down, an administrator or developer must formally request access before they can connect.
1. In the Azure Portal, navigate to the specific **Virtual Machine**.
2. In the left menu, click on **Connect**, then select **RDP** (or SSH).
3. The portal will detect that JIT is enabled. A banner will appear stating: *”Just-in-time network access policy is active on this VM.”*
4. Under the **Source IP** section, select **My IP**. This will automatically detect your current public IP address.
5. Click the **Request access** button.
### What Happens Behind the Scenes?
1. Azure verifies your RBAC permissions to ensure you are authorized to make the request.
2. Azure accesses the NSG applied to the VM’s network interface.
3. It injects a temporary, high-priority “Allow” rule explicitly for port 3389, originating *only* from your specific IP address.
4. A countdown timer begins.
Once the access request is approved (usually within 5 seconds), you can click **Download RDP File** and connect to the server normally.
When the configured time limit expires, Azure automatically removes the temporary Allow rule from the NSG, instantly severing any active connections and returning the VM to a secure, locked-down state.
By implementing JIT, you eliminate the threat of continuous automated port scanning while maintaining critical management access for authorized personnel.