Lock-chamber NSGs currently allow TCP 3389 from Any so night shift can always reach the VMs. How should just-in-time (JIT) VM access change that posture?
Select an answer to reveal the explanation.
Short Explanation
Standing Allow-3389-from-anywhere is a door propped open all night. JIT keeps that door locked until someone with a good reason asks for a short, approved window—then it shuts again.
Full Explanation
Just-in-time (JIT) VM access changes the lock-chamber posture by keeping management ports denied by default and opening them only for an approved, time-bound request from an allowed source. Instead of a standing NSG Allow for TCP 3389 from Any, Defender for Servers JIT temporarily adjusts network security so night shift gets a short window, then the deny posture returns when the request expires. That shrinks the permanent Internet-facing management surface on the canal VMs.
Replacing the NSG with an Application Security Group that permanently allows 3389 from the entire VNet fails by concept: ASGs group NICs for rule authoring; they do not provide time-boxed JIT, and a permanent allow from the whole VNet is still standing access. Moving only to Bastion and deleting all NSG rules because “JIT cannot control management ports” is wrong—JIT’s purpose is exactly to control when management ports are allowed, and Bastion does not make NSG deny-by-default irrelevant. Assigning Contributor at subscription scope so operators can rewrite NSG Allows whenever they need RDP fails because broad standing write access is privilege sprawl, not just-in-time network control.
Exam caveat: JIT is a Microsoft Defender for Servers capability; without the appropriate plan, JIT cannot be configured even if NSGs exist. Operational check: after enabling JIT, verify default deny on 3389/22, submit a test request from an approved source with a short duration, confirm the temporary allow appears, and confirm the port closes again when the window ends.