Lock-chamber NSGs currently allow TCP 3389 from Any so night shift can always reach the VMs. How should just-in-time (JIT) VM access change that posture?
Select an answer to reveal the explanation.
Short Explanation
Standing Allow-3389-from-anywhere is a door propped open all night. JIT keeps that door locked until someone with a good reason asks for a short, approved window—then it shuts again.
Full Explanation
Just-in-time VM access is a Defender for Cloud compute-access control that keeps management ports such as 22 and 3389 denied until an approved, time-bound request temporarily relaxes NSG (and related) rules from a specified source. It complements Bastion rather than replacing network controls entirely. Permanent Any Allow rules and broad Contributor rights that let operators rewrite NSGs undo least privilege. This item is about timed compute access, not Secure Score inventory alone.