Using Just-in-Time Access to Improve Azure Virtual Machines

by | Jul 10, 2026 | Azure, Security

Azure Virtual Machines usually need remote access for management. But leaving management ports such as RDP (port 3389) or SSH (port 22) open can make them more vulnerable to unauthorized access.
Microsoft Defender for Cloud includes Just-in-Time (JIT) VM access. This feature only opens management ports when an authorized user requests access for a limited time. It helps keep your VMs secure while still allowing needed administration. JIT VM access is available with Microsoft Defender for Servers Plan 2.

How It Works

If an administrator needs to connect to a Windows VM with RDP, JIT lets them request temporary access from a trusted IP address. After the access period ends, the system closes the port automatically.

Demo: Enable JIT Access for an Azure VM

Open Microsoft Defender for Cloud

Sign in to the Azure portal.

Search for Microsoft Defender for Cloud

Management, choose Environment settings

select your Azure Subscription

In the Settings menu, select “Defender Plans” then toggle the “Servers Plan” status to On and choose Save.

After saving the Defender for Server Plan, the next step is to enable it on the Azure VM for which you want to allow unauthorized network access temporarily.

Enable Just In Time access to a VM

Click on the “Not configured” virtual machines tab.

Select the VM to protect.

Then go to Settings and choose Configuration.

Click “Enable just-in-time”

Request Temporary Access

Search for Defender for Cloud, go to Cloud Security > Workload protections, and choose Just-in-time VM access.

Now, the list of configured VMs with just-in-time VM access will be present.

 

Request Temporary Access

To request access to the VM that previously had JIT access enabled, go to the “Configured” tab. Select your VM and click “Request access”.

Choose port 3389, enter your source IP address, select how long access should be allowed, enter your request justification, and click the “Open ports” button at the bottom right.


After access is granted, connect to the VM with Remote Desktop.

Best Practices

  • Limit access to trusted IP addresses.
  • Set the shortest possible access duration.
  • Review JIT activity for unexpected requests.
  • Use least-privilege Azure RBAC permissions and strong authentication.
JIT helps lower network exposure, but you still need to keep systems updated, protect endpoints, and manage identities securely.
To sum up, Just-in-Time VM access is a strong way to protect Azure VM management ports. Giving access only when needed boosts security and helps you manage admin access better.

References

468
Share This