Microsoft Defender for Cloud
Vulnerabilities and exposureUnderstand just-in-time virtual machine access
In brief
The article now uses clearer Azure and AWS headings, anchors, and tab identifiers; clarifies approved access requests and expiration behavior; and adds decision-flow diagram references and a next-steps link.
What Defender admins need to know
Administrators can more easily navigate the guidance and follow the documented access workflow.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Just-in-time machine access in Microsoft Defender for Cloud
Microsoft Defender for Cloud's Defender for Servers Plan 2 offers the just-in-time machine access feature. Just-in-time protects your resources from threat actors actively hunting for machines with open management ports, such as Remote Desktop Protocol (RDP) or Secure Shell (SSH). All machines are potential targets for attacks. Once compromised, a machine can serve as an entry point to further attack resources in the environment.
Just-in-time access and network resources
Just-in-time access for Azure resources
In Azure, enable just-in-time access to block inbound traffic on specific ports.
- If other rules already exist for the selected ports, those existing rules take priority over the new "deny all inbound traffic" rules.
- If no existing rules are on the selected ports, the new rules take top priority in the NSG and Azure Firewall.
Amazon Web ServicesJust-in-time access for AWS resources
In Amazon Web Services (AWS), enable just-in-time access to revoke the relevant rules in the attached EC2 security groups (for the selected ports), blocking inbound traffic on those specific ports.
- When a user requests access to a VM, Defender for Servers checks that the user has Azure role-based access control (Azure RBAC) permissions for that VM.
- If the user's access request is approved, Defender for Cloud configures the NSGs and Azure Firewall to allow inbound traffic to the selected ports from the relevant IP address (or range) for the specified amount of time.
- In AWS, Defender for Cloud creates a new EC2 security group that allows inbound traffic to the specified ports.
- After the
timeapproved access period expires, Defender for Cloud restores the NSGs to their previous states. - Connections that are already established aren't interrupted.
The following diagram shows the logic that Defender for Servers applies when deciding how to categorize your supported VMs:
Azure
The following diagram shows the decision flow for Azure VMs:
:::image type="content" source="media/just-in-time-explained/jit-logic-flow.png" alt-text="Just-in-time (JIT) virtual machine (VM) logic flow." lightbox="media/just-in-time-explained/jit-logic-flow.png":::
AWSAWS
The following diagram shows the decision flow for AWS machines:
:::image type="content" source="media/just-in-time-explained/aws-jit-logic-flow.png" alt-text="A chart that explains the logic flow for the AWS just-in-time logic flow.":::
:::image type="content" source="media/just-in-time-explained/unhealthy-resources.png" alt-text="Screenshot that shows an unhealthy resource." lightbox="media/just-in-time-explained/unhealthy-resources.png":::
Next stepsteps
To configure just-in-time access, continue to the following article:
[!div class="nextstepaction"] Enable just-in-time access on VMs
@@ -1,13 +1,14 @@ --- title: Understand just-in-time virtual machine access-description: This document explains how just-in-time VM access in Microsoft Defender for Cloud helps you control access to your Azure virtual machines+description: Learn how just-in-time VM access in Microsoft Defender for Cloud reduces attack surface by locking down inbound management ports and allowing access only when needed. ms.topic: how-to-ms.date: 05/28/2026+ms.date: 07/03/2026+ms.custom: msecd-doc-authoring-1013 #customer intent: As a security administrator, I want to understand just-in-time VM access so that I can control access to my Azure virtual machines. ai-usage: ai-assisted --- -# Just-in-time machine access+# Just-in-time machine access in Microsoft Defender for Cloud Microsoft Defender for Cloud's Defender for Servers Plan 2 offers the just-in-time machine access feature. Just-in-time protects your resources from threat actors actively hunting for machines with open management ports, such as Remote Desktop Protocol (RDP) or Secure Shell (SSH). All machines are potential targets for attacks. Once compromised, a machine can serve as an entry point to further attack resources in the environment. @@ -17,7 +18,8 @@ Defender for Cloud's just-in-time machine access feature locks down inbound traf ## Just-in-time access and network resources -### Azure+<a name="azure"></a>+### Just-in-time access for Azure resources In Azure, enable just-in-time access to block inbound traffic on specific ports. @@ -26,14 +28,15 @@ In Azure, enable just-in-time access to block inbound traffic on specific ports. - If other rules already exist for the selected ports, those existing rules take priority over the new "deny all inbound traffic" rules. - If no existing rules are on the selected ports, the new rules take top priority in the NSG and Azure Firewall. -### Amazon Web Services+<a name="amazon-web-services"></a>+### Just-in-time access for AWS resources In Amazon Web Services (AWS), enable just-in-time access to revoke the relevant rules in the attached EC2 security groups (for the selected ports), blocking inbound traffic on those specific ports. - When a user requests access to a VM, Defender for Servers checks that the user has [Azure role-based access control (Azure RBAC)](/azure/role-based-access-control/role-assignments-portal) permissions for that VM.-- If the request is approved, Defender for Cloud configures the NSGs and Azure Firewall to allow inbound traffic to the selected ports from the relevant IP address (or range) for the specified amount of time.+- If the user's access request is approved, Defender for Cloud configures the NSGs and Azure Firewall to allow inbound traffic to the selected ports from the relevant IP address (or range) for the specified amount of time. - In AWS, Defender for Cloud creates a new EC2 security group that allows inbound traffic to the specified ports.-- After the time expires, Defender for Cloud restores the NSGs to their previous states.+- After the approved access period expires, Defender for Cloud restores the NSGs to their previous states. - Connections that are already established aren't interrupted. > [!NOTE]@@ -44,11 +47,15 @@ In Amazon Web Services (AWS), enable just-in-time access to revoke the relevant The following diagram shows the logic that Defender for Servers applies when deciding how to categorize your supported VMs: -### [**Azure**](#tab/defender-for-container-arch-aks)+### [**Azure**](#tab/jit-azure)++The following diagram shows the decision flow for Azure VMs: :::image type="content" source="media/just-in-time-explained/jit-logic-flow.png" alt-text="Just-in-time (JIT) virtual machine (VM) logic flow." lightbox="media/just-in-time-explained/jit-logic-flow.png"::: -### [**AWS**](#tab/defender-for-container-arch-eks)+### [**AWS**](#tab/jit-aws)++The following diagram shows the decision flow for AWS machines: :::image type="content" source="media/just-in-time-explained/aws-jit-logic-flow.png" alt-text="A chart that explains the logic flow for the AWS just-in-time logic flow."::: @@ -58,7 +65,10 @@ When Defender for Cloud finds a machine that can benefit from just-in-time acces :::image type="content" source="media/just-in-time-explained/unhealthy-resources.png" alt-text="Screenshot that shows an unhealthy resource." lightbox="media/just-in-time-explained/unhealthy-resources.png"::: -## Next step+<a name="next-step"></a>+## Next steps++To configure just-in-time access, continue to the following article: > [!div class="nextstepaction"] > [Enable just-in-time access on VMs](just-in-time-access-usage.yml)