Management ports of virtual machines should be protected with just-in-time network access control

What does the recommendation "Management ports of virtual machines should be protected with just-in-time network access control" check?

Flags virtual machines whose management ports (SSH 22, RDP 3389 and WinRM 5985/5986 by default) are reachable from the network without a just-in-time (JIT) access policy in Microsoft Defender for Cloud. It checks that a JIT policy exists and governs those ports, so they sit behind a deny-all inbound rule that is only opened on request, for an approved source IP, for a limited time. It does not check whether the ports are currently open, nor does it cover data-plane ports, application traffic, or VMs reached solely through Azure Bastion or a private network where no public management exposure exists.

Why does "Management ports of virtual machines should be protected with just-in-time network access control" matter?

Permanently open RDP and SSH ports are among the most heavily scanned and brute-forced surfaces on the internet, and a single exposed VM is enough for an attacker to gain a foothold, move laterally and deploy ransomware. Standing access means the window is always open, even at 3am when nobody is administering the box, and automated scanners find a freshly exposed management port within minutes. JIT inverts that posture: the port stays closed behind a deny-all inbound rule by default and is exposed only for the minutes an engineer actually needs it, scoped to their source address alone. That collapses the attack surface and leaves a clear audit trail of who requested access, to which VM and for how long, which is exactly the evidence auditors and incident responders ask for.

How do I fix "Management ports of virtual machines should be protected with just-in-time network access control"?

1. Enable Microsoft Defender for Servers Plan 2 on the subscription, since JIT depends on it, and confirm each target VM has a network security group (or Azure Firewall) associated so Defender for Cloud has somewhere to write the deny and allow rules.
2. Create a JIT policy on the VM from Defender for Cloud (Workload protections, Just-in-time VM access) or programmatically with the Set-AzJitNetworkAccessPolicy PowerShell cmdlet or the equivalent REST API, specifying the protected ports, allowed source IP ranges and the maximum request duration.
3. Move administrators to requesting time-boxed access through the 'Request access' action rather than leaving standing inbound management rules in place, and grant the roles needed to request and configure JIT (Security Admin or Contributor on the resource group or subscription) only to the people who genuinely need them.

# 1. Close the highest-impact exposure first: delete any rule that
#    allows a management port from the whole internet.
for rule in $(az network nsg rule list -g prod-rg --nsg-name prod-nsg \
    --query "[?access=='Allow' && (sourceAddressPrefix=='*' || sourceAddressPrefix=='Internet') && (destinationPortRange=='3389' || destinationPortRange=='22')].name" -o tsv); do
  az network nsg rule delete -g prod-rg --nsg-name prod-nsg -n "$rule"
  echo "$rule: open management-port rule removed"
done

# 2. Add an explicit deny on the management ports as a backstop.
az network nsg rule create -g prod-rg --nsg-name prod-nsg \
  --name deny-mgmt-ports --priority 4000 --access Deny --direction Inbound \
  --protocol Tcp --source-address-prefixes Internet \
  --destination-port-ranges 22 3389

# 3. Gate the ports you still need behind just-in-time access.
#    JIT is configured via PowerShell or the portal; request access with the CLI:
az security jit-policy list -o table   # confirm the JIT policy is in place

# 4. Ratchet it shut: audit any VM left without an NSG (Defender built-in policy).
az policy assignment create \
  --name audit-internet-facing-nsg \
  --policy f6de0be7-9a8a-4b8a-b349-43cf02d22f7c \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"