Just-in-time VM access will not enable on a grain-elevator virtual machine because the subscription lacks a workload protection plan. What should the security engineer identify as the prerequisite?
Select an answer to reveal the explanation.
Short Explanation
JIT isn’t a free NSG trick—you need Microsoft Defender for Servers on the plan. Don’t “fix” a missing plan by nailing 3389 open forever.
Full Explanation
Just-in-time VM access requires Microsoft Defender for Servers (workload protection) on the relevant subscription or scope. Without that plan, JIT cannot be enabled on the VM. Permanently opening management ports is not an acceptable substitute. Defender for Storage and DDoS Protection Standard address different workloads and do not unlock JIT for virtual machines. Avoid turning the item into a full Defender-plan catalog dump; name the Servers prerequisite and keep management ports closed by default.