Secure your management ports with just-in-time access

• Configured – VMs that have been already been configured to support just-in-time VM access. For each VM, the configured tab shows:
  • the number of approved JIT requests in the last seven days
  • the last access date and time
  • the connection details configured
  • the last user
• Not configured – VMs without JIT enabled, but that can support JIT. We recommend that you enable JIT for these VMs.
• Unsupported – VMs without JIT enabled and which don’t support the feature. Your VM might be in this tab for the following reasons:
  • Missing network security group (NSG) or Azure Firewall – JIT requires an NSG to be configured or a Firewall configuration (or both)
  • Classic VM – JIT supports VMs that are deployed through Azure Resource Manager, not ‘classic deployment’.
  • Other – Your VM might be in this tab if the JIT solution is disabled in the security policy of the subscription or the resource group.

• 22 – SSH
• 3389 – RDP
• 5985 – WinRM
• 5986 – WinRM

To accept the default settings, select Save.

• Add custom ports with the Add button.
• Modify one of the default ports, by selecting it from the list.

For each port (custom and default) the Add port configuration pane offers the following options:

• Protocol– The protocol that is allowed on this port when a request is approved
• Allowed source IPs– The IP ranges that are allowed on this port when a request is approved
• Maximum request time– The maximum time window during which a specific port can be opened

1. Set the port security to your needs.
2. Select OK.