A reviewer treats Azure Bastion and just-in-time VM access as the s…

Question

A reviewer treats Azure Bastion and just-in-time VM access as the same control for lock-chamber servers. How should the security engineer describe their relationship?

Accepted Answer

Keep both: Bastion is the brokered session path without a public IP on the VM, and JIT is the time-boxed network allow on the management port from an approved source such as AzureBastionSubnet. — Bastion is the private hallway into the lock house; JIT is the timed key that opens the management door. You want the hallway and the timed key—not one confused for the other.

Answer

Choose only Bastion because JIT permanently replaces NSG denies and makes Bastion unnecessary for private VMs.

Answer

Choose only JIT because a time-bound NSG Allow from the Internet is equivalent to Bastion’s TLS brokering.

Answer

Replace both with Privileged Identity Management eligible Owner on the VM so network path and ports no longer matter.

A reviewer treats Azure Bastion and just-in-time VM access as the same control for lock-chamber servers. How should the security engineer describe their relationship?

Short Explanation

Full Explanation