How do you use Just-in-Time VM access in Microsoft Defender for Cloud?

Use Just-in-Time VM access by keeping management ports closed by default and opening them only for approved, time-limited access when needed. Limit the source addresses and duration, then close the exposure automatically after use. Review requests and activity frequently, because the main control is reducing how long privileged network paths stay open.

How Just-in-Time VM access works in Defender for Cloud

Just-in-Time VM access is a network exposure control, not a login feature. You use it to keep management ports closed by default, then request a temporary opening only when you need to administer a VM. The key idea is to shrink the window in which RDP, SSH, or similar ports are reachable from the network.

When the request is approved, Defender for Cloud opens the selected port for the selected source addresses and for a defined duration. That means the control is doing two jobs at once: reducing routine exposure and limiting who can reach the VM while the access window is active. For Azure-focused hardening patterns, see the Microsoft Azure Security Guide.

In practice, this works best when the VM still has a separate administrative path, such as privileged identity controls or a bastion-style workflow, so Just-in-Time access is used as the temporary exception path rather than the normal operating state. That distinction matters because the control is most effective when it reduces standing exposure instead of simply moving the same exposure into a shorter time window.

What to set before you rely on it

You need to define which VMs are eligible, which management ports can be opened, which sources may request access, and how long the window can remain open. Those choices determine whether the control is genuinely restrictive or merely convenient. If you allow broad source ranges or long durations, you preserve too much of the original attack surface.

Use the approval workflow to align the request with a real administrative task, then keep the request scope as narrow as possible. The strongest setup is one where the request is tied to a specific port, a specific VM, a specific source IP range, and the shortest workable duration. That is why Just-in-Time access fits naturally with Privileged Access Management Guide patterns and with the broader move toward Just-in-Time Access and Zero Standing Privilege Guide.

Review the eligible VMs regularly. A VM that no longer needs interactive administration, or that has been rebuilt into a more automated workflow, should not keep the same exception profile forever. If the environment uses cloud privilege governance, the Cloud PAM and CIEM Guide is the right companion for reducing unnecessary access paths around the VM itself.

What happens after the window closes

Once the approved time expires, the port closes again automatically, which is the main operational benefit. You are not trying to remember to shut the path back down, and you are not leaving an exposed management surface open after the work is finished. That automatic reclosure is what makes the control valuable in environments where privileged access is needed often but should not remain continuously reachable.

Because the access path is temporary, review logs and requests after the fact. You want to know who requested access, what source address was used, which VM was opened, and whether the activity matched the stated purpose. If you need a stronger administrative evidence trail, pair the control with session oversight and review the resulting activity, not just the fact that the port was opened.

Risk and Threat Considerations

Just-in-Time VM access reduces the time a management port is reachable, but it does not remove the underlying risk of privileged remote access. If the approval process is too broad, or if source restrictions are weak, an attacker who gains access during the window can still reach an administrative interface that would otherwise have been closed. The main risk is overextending a temporary exception until it behaves like standing access.

Failure mechanism: Exposure persists because the approved window, source scope, or port scope is too permissive, or because admins treat the exception as routine and let it become a long-lived operational habit.

Impact: A compromised or abused access window can enable direct administrative access, malware deployment, configuration tampering, or lateral movement while the port is open.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	AC-17 — Remote Access	Just-in-time VM access governs temporary remote administrative access to systems.
	AC-6 — Least Privilege	The control narrows who can open management ports and for how long.
	AU-2 — Event Logging	JIT requests and openings need traceable records for later review.
Recommendation — Restrict remote admin access to approved, time-bound sessions and document each exception. Limit each access request to the minimum source, port, and duration needed. Log each approval, port opening, and closure for after-action review.
ISO/IEC 27001:2022	A.5.15 — Access control	JIT VM access is an access-control measure for temporary administrative reachability.
Recommendation — Define rules for granting, limiting, and revoking temporary administrative access.
CIS Controls v8	CIS-6 — Access Control Management	The topic is about reducing and governing administrative access exposure.
Recommendation — Remove standing admin exposure and enforce time-limited access exceptions.

Practitioner Guidance

What to verify: Check that the approval path really constrains the request to the smallest practical port list, source set, and duration. If the same people can repeatedly re-open broad access without scrutiny, the control is not materially reducing exposure.

Common mistake: Treating Just-in-Time access as a substitute for privilege design. It should reduce exposure around an already-necessary admin path, not compensate for unmanaged standing privilege or weak role design.

What good looks like: Management ports stay closed by default, requests are short and specific, and the approval record explains why the temporary access was necessary. The operational goal is fewer always-on admin paths, not merely faster exception handling.

Practitioner takeaway: Use Just-in-Time VM access to make privileged reachability exceptional, narrow, and observable. If the exception becomes broad or habitual, the control has stopped delivering its core security value.