Just-in-time VM access will not enable on a grain-elevator virtual machine because the subscription lacks a workload protection plan. What should the security engineer identify as the prerequisite?
Select an answer to reveal the explanation.
Short Explanation
JIT isn’t a free NSG trick—you need Microsoft Defender for Servers on the plan. Don’t “fix” a missing plan by nailing 3389 open forever.
Full Explanation
Just-in-time VM access depends on Microsoft Defender for Servers being enabled at the subscription or other applicable scope that covers the grain-elevator virtual machine. Without that workload protection plan, the JIT experience will not configure on the VM even though NSGs and Bastion may already exist. The security engineer’s first fix is therefore the Defender for Servers prerequisite, not a permanent open management port.
Opening TCP 3389 permanently from Any and calling that “equivalent to JIT” fails by concept: a standing allow is the opposite of time-bound, request-based access. Enabling Microsoft Defender for Storage on a diagnostic storage account fails because Storage protection does not unlock JIT for compute VMs. Purchasing Azure DDoS Protection Standard on the elevator VNet fails because DDoS Network Protection mitigates volumetric attacks on public IPs; it is not bundled as a substitute for Defender for Servers JIT.
Exam caveat: Defender plans are scoped (subscription, resource group, or resource depending on how you enable them)—confirm the elevator VM is actually covered by Servers, not only that some other Defender product is on elsewhere in the tenant. Operational check: in Microsoft Defender for Cloud, verify Servers is on for the scope, open the VM’s JIT blade, configure ports, and confirm a request can be initiated successfully.