Enable just

You can use Microsoft Defender for Cloud's just-in-time (JIT) access to protect your Azure virtual machines (VMs) from unauthorized network access. Many times firewalls contain allow rules that leave your VMs vulnerable to attack. JIT lets you allow access to your VMs only when the access is needed, on the ports needed, and for the period of time needed.

Learn more about how JIT works and the permissions required to configure and use JIT.

In this article, you learn how to include JIT in your security program, including how to:

JIT requires Microsoft Defender for Servers Plan 2 to be enabled on the subscription.

Reader and SecurityReader roles can both view the JIT status and parameters.

If you want to create custom roles that work with JIT, you need the details from the following table:

Note

Only the Microsoft.Security permissions are relevant for AWS.

To set up JIT on your Amazon Web Service (AWS) VM, you need to connect your AWS account to Microsoft Defender for Cloud.

Tip

To create a least-privileged role for users that need to request JIT access to a VM, and perform no other JIT operations, use the Set-JitLeastPrivilegedRole script from the Defender for Cloud GitHub community pages.

Note

In order to successfully create a custom JIT policy, the policy name, together with the targeted VM name, must not exceed a total of 56 characters.

You can use Defender for Cloud or you can programmatically enable JIT VM access with your own custom options, or you can enable JIT with default, hard-coded parameters from Azure virtual machines.

Just-in-time VM access shows your VMs grouped into:

From Defender for Cloud, you can enable and configure the JIT VM access.

Open the Workload protections and, in the advanced protections, select Just-in-time VM access.

In the Not configured virtual machines tab, mark the VMs to protect with JIT and select Enable JIT on VMs.

The JIT VM access page opens listing the ports that Defender for Cloud recommends protecting:

To customize the JIT access:

Select Add.

Select one of the ports in the list to edit it or enter other ports. For each port, you can set the:

Select OK.

To save the port configuration, select Save.

You can modify a VM's just-in-time configuration by adding and configuring a new port to protect for that VM, or by changing any other setting related to an already protected port.

To edit the existing JIT rules for a VM:

Open the Workload protections and, in the advanced protections, select Just-in-time VM access.

In the Configured virtual machines tab, right-click on a VM and select Edit.

In the JIT VM access configuration, you can either edit the list of port or select Add a new custom port.

When you finish editing the ports, select Save.

When a VM has a JIT enabled, you have to request access to connect to it. You can request access in any of the supported ways, regardless of how you enabled JIT.

From the Just-in-time VM access page, select the Configured tab.

Select the VMs you want to access:

The icon in the Connection Details column indicates whether JIT is enabled on the network security group or firewall. If it's enabled on both, only the firewall icon appears.

The Connection Details column shows the user and ports that can access the VM.

Select Request access. The Request access window opens.

Under Request access, select the ports that you want to open for each VM, the source IP addresses that you want the port opened on, and the time window to open the ports.

Select Open ports.

Note

If a user who is requesting access is behind a proxy, you can enter the IP address range of the proxy.

You can enable JIT on a VM from the Azure virtual machines pages of the Azure portal.

Tip

If a VM already has JIT enabled, the VM configuration page shows that JIT is enabled. You can use the link to open the JIT VM access page in Defender for Cloud to view and change the settings.

From the Azure portal, search for and select Virtual machines.

Select the virtual machine you want to protect with JIT.

In the menu, select Configuration.

Under Just-in-time access, select Enable just-in-time.

By default, just-in-time access for the VM uses these settings:

To edit any of these values or add more ports to your JIT configuration, use Microsoft Defender for Cloud's just-in-time page:

From Defender for Cloud's menu, select Just-in-time VM access.

From the Configured tab, right-click on the VM to which you want to add a port, and select Edit.

Under JIT VM access configuration, you can either edit the existing settings of an already protected port or add a new custom port.

When you've finished editing the ports, select Save.

When a VM has a JIT enabled, you have to request access to connect to it. You can request access in any of the supported ways, regardless of how you enabled JIT.

To request access from Azure virtual machines:

In the Azure portal, open the virtual machines pages.

Select the VM to which you want to connect, and open the Connect page.

Azure checks to see if JIT is enabled on that VM.

If JIT isn't enabled for the VM, you're prompted to enable it.

If JIT is enabled, select Request access to pass an access request with the requesting IP, time range, and ports that were configured for that VM.

Note

After a request is approved for a VM protected by Azure Firewall, Defender for Cloud provides the user with the proper connection details (the port mapping from the DNAT table) to use to connect to the VM.

To enable just-in-time VM access from PowerShell, use the official Microsoft Defender for Cloud PowerShell cmdlet Set-AzJitNetworkAccessPolicy.

Example - Enable just-in-time VM access on a specific VM with the following rules:

The following PowerShell commands create this JIT configuration:

Assign a variable that holds the just-in-time VM access rules for a VM:

Insert the VM just-in-time VM access rules into an array:

Configure the just-in-time VM access rules on the selected VM:

Use the -Name parameter to specify a VM. For example, to establish the JIT configuration for two different VMs, VM1 and VM2, use: Set-AzJitNetworkAccessPolicy -Name VM1 and Set-AzJitNetworkAccessPolicy -Name VM2.

In the following example, you can see a just-in-time VM access request to a specific VM for port 22, for a specific IP address, and for a specific amount of time:

Run the following commands in PowerShell:

Configure the VM request access properties:

Insert the VM access request parameters in an array:

Send the request access (use the resource ID from step 1)

Learn more in the PowerShell cmdlet documentation.

The just-in-time VM access feature can be used via the Microsoft Defender for Cloud API. Use this API to get information about configured VMs, add new ones, request access to a VM, and more.

Learn more at JIT network access policies.

The just-in-time VM access feature can be used via the Microsoft Defender for Cloud API. Use this API to get information about configured VMs, add new ones, request access to a VM, and more.

Learn more at JIT network access policies.

You can gain insights into VM activities using log search. To view the logs:

From Just-in-time VM access, select the Configured tab.

For the VM that you want to audit, open the ellipsis menu at the end of the row.

Select Activity Log from the menu.

The activity log provides a filtered view of previous operations for that VM along with time, date, and subscription.

To download the log information, select Download as CSV.

In this article, you learned how to configure and use just-in-time VM access. To learn why you should use JIT, read the article that explains the threats JIT defends against:

JIT explained