As you start working with your virtual machines in the cloud,
no doubt, you will have management ports.
These management ports can be either Remote Desktop, SSH, or more.
And ultimately, it allows you to manage your servers.
The problem with these management ports is that if they are not protected,
then they are vulnerable to threat actors ultimately getting access to them.
For example,
if you go ahead and spin up a new virtual machine in Azure and
you do not restrict who can connect to those management ports
in the form of an IP address, after a minute or so,
you will see a number of events of different IPs
trying to access that virtual machine.
So due to this, Microsoft has come up with a really great solution,
which is called just‑in‑time access.
And this solution addresses one of the cybersecurity prevention techniques,
and that is having as few as possible ports that are
open to your virtual machines.
Now just‑in‑time access, also known as JIT for short,
can be enabled really easily.
There are two ways that we can enable this, so let's explore both ways.
The first way that we're going to explore is enabling it
directly from our virtual machine.
So I'm going to navigate to Virtual machines, and I'm going to select my mem1.
And within the Azure machine page, on the left‑hand side,
I'm going to drop down and select Configuration.
Within Configuration, you will notice on the top,
it gives me the option to Enable just‑in‑time VM access.
So I'm going to go ahead and click on Enable,
and now Azure has enabled just‑in‑time VM access.
It's as simple as that.
Now in order for me to make use of just‑in‑time access,
I would need to leverage it from Microsoft Defender for Cloud.
You'll see here that I have an option to Open Microsoft Defender for Cloud.
So I'll click on the link,
and this will take me directly to the Just‑in‑time access page,
where I can now interact and request access to the virtual machine.
Now before we go ahead and request access,
I'm going to switch back to my Azure main page.
And I'm going to go to my Microsoft Defender for Cloud component,
and I want to show you how we can enable just‑in‑time access
from within Microsoft Defender for Cloud.
To do this, I'm going to navigate to Workload protections.
And at the bottom, under Advanced protection,
we have a card that says Just‑in‑time VM access.
So I will click on this card,
and this will take me directly to the same page as what we've seen.
But now, from this page, I can click on Not Configured,
and we'll see that I've got mem3, which is not configured,
and all I need to do is select it and click on Enable JIT.
Now I have a list of ports that relate to management of my server.
From here, I can actually go ahead and add additional ports if I wanted to,
and I can also delete any ports that I would not want to
be protected by just‑in‑time access.
So I'm going to leave these as it is, and I'm going to click on Save,
and now just‑in‑time access has been enabled.
If I had any virtual machines that were not supported,
these would show up in the Unsupported tab.
All right, so now we've got just‑in‑time access enabled,
let's go ahead and actually request access.
So I'm going to go ahead and do this for my mem3 server.
And I'm going to click on my mem3 server and click on Request access.
And I'm brought to the page where I can select which
management port I would like to access.
In my case, I want to access port 3389.
And I'm going to go ahead and define an IP Range,
which is my public IP,
and then I can select a time range of how long I want my access to be valid for.
So the maximum that I have is 3 hours, I'm going to go ahead and select 2 hours,
and I will provide a justification.
Finally, I'll go ahead and click on Open ports,
and now the request has been initiated.
We see immediately that connection details shows me that
ports are open and who has requested it.
I can also see that the access is currently active right now.
This means that I can now initiate a remote desktop connection to the server.
After 2 hours, this port will be closed.
Now what if I wanted to monitor or look at who actually requested access?
I could take a look at this from the Activity log.
The Activity log will show me all of the different types of activities
that happened in relation to just‑in‑time access.
For instance,
I have three activities that show me that the JIT
Network Access Policy was created, it was updated,
and then access was requested.
So I'm going to go ahead and click on one of those,
and I'll see the full details of this event and the event in JSON format.
All right, so now, if I wanted to remove just‑in‑time access,
this can also be done within Microsoft Defender for Cloud.
All I need to do is click on my options and then select Remove.
I will then get a prompt asking me to confirm the action.
And after I clicked on Yes,
we see that just‑in‑time access has been removed for that machine.
Now if I take a look at my Not Configured virtual machines,
we see that the member server shows up.
So this concludes how we can quickly enable protection
capabilities on our management ports.
As you can see, it is really easy and super simple to configure,
and it is such a great resource because it really enables
some really great protections on something that is crucial to management of your servers.