A contractor requests just-in-time access to a lock-chamber VM from…

Question

A contractor requests just-in-time access to a lock-chamber VM from a coffee-shop IP that is not on the allowed prefix and leaves the window open for days. Which JIT configuration should the security engineer enforce?

Accepted Answer

Configure allowed source IPs, permitted ports such as 22 or 3389, and a short maximum request duration so the NSG allow is revoked when the window ends. — JIT isn’t a weekend pass from the coffee shop. Lock the allowed source, the ports, and a short max window—when time’s up, the NSG deny comes back.

Answer

Allow any source IP, set the maximum duration to several days, and rely on Entra Privileged Identity Management alone to close the NSG when the shift ends.

Answer

Disable source IP checks and permanently allow 3389 from AzureBastionSubnet without a time limit once the first JIT request succeeds.

Answer

Require the contractor to activate an eligible Global Administrator role in PIM instead of requesting JIT on the VM.

A contractor requests just-in-time access to a lock-chamber VM from a coffee-shop IP that is not on the allowed prefix and leaves the window open for days. Which JIT configuration should the security engineer enforce?

Short Explanation

Full Explanation