Just-in-time (JIT) VM access is a feature of Microsoft Defender for Cloud designed specifically to address this security requirement. It locks down inbound traffic to Azure virtual machines by creating a deny rule for high-risk ports, such as Remote Desktop (RDP) port 3389, in the associated Network Security Group (NSG). When an authorized user needs to connect, they request access through Defender for Cloud. If approved, JIT creates a temporary, time-bound allow rule with a higher priority, permitting access from a specific source IP address for a limited duration. This ensures the port is closed by default and only opened on-demand for legitimate, authorized sessions.

A. Azure AD PIM provides just-in-time privileged access by managing role assignments, not by controlling network port access on a VM.
B. An application security group is used to group VMs to simplify the application of static network security rules, but it does not provide an on-demand access mechanism.
C. Azure AD Conditional Access enforces policies on user sign-ins and access to cloud applications, not on network-level access to VM ports.

1. Microsoft Defender for Cloud documentation

"Understanding just-in-time (JIT) VM access": "When JIT is enabled

Defender for Cloud locks down inbound traffic to your Azure VMs by creating a rule in your network security group... When a user requests access to a VM

Defender for Cloud checks that the user has permissions... If the request is approved

Defender for Cloud configures the Network Security Groups (NSGs)... to allow inbound traffic to the selected ports from the requested IP address... for the amount of time that was specified."

Source: Microsoft Learn

learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview

Section: "How does JIT access work?".

2. Azure Active Directory documentation

"What is Privileged Identity Management?": "Azure Active Directory (Azure AD) Privileged Identity Management (PIM) is a service that enables you to manage

control

and monitor access to important resources... PIM provides time-based and approval-based role activation to mitigate the risks of excessive

unnecessary

or misused access permissions on resources that you care about."

Source: Microsoft Learn

learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure

Section: "What does it do?".

3. Azure Virtual Network documentation

"Application security groups": "Application security groups enable you to configure network security as a natural extension of an application's structure

allowing you to group virtual machines and define network security policies based on those groups."

Source: Microsoft Learn

learn.microsoft.com/en-us/azure/virtual-network/application-security-groups

Section: "Overview".

4. Azure Active Directory documentation

"What is Conditional Access?": "Conditional Access is the tool used by Azure Active Directory to bring signals together

to make decisions

and enforce organizational policies. Conditional Access is at the heart of the new identity-driven control plane."

Source: Microsoft Learn

learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview

Section: "Overview".