Management ports should be closed on your virtual machines

What does the recommendation "Management ports should be closed on your virtual machines" check?

Flags any virtual machine whose management ports, typically RDP (3389), SSH (22) and WinRM (5985/5986), are reachable from the internet because a network security group rule allows inbound traffic from a broad source such as Any, Internet or 0.0.0.0/0. It assesses the effective NSG rules on the VM's NIC and subnet, not whether anyone is actually logging in. It does not inspect application ports like 80 or 443, and it does not check the strength of the credentials behind the port.

Why does "Management ports should be closed on your virtual machines" matter?

An internet-facing RDP or SSH port is the front door most opportunistic attacks knock on. Automated bots scan the public IPv4 range continuously and launch credential-stuffing and brute-force runs against any open 3389 or 22 within minutes of exposure. A single guessed or reused password hands an attacker an interactive session on the host, which is the usual first step toward ransomware, lateral movement and data theft. Closing the port by default removes the attack surface entirely, so a weak password on one VM no longer becomes a breach of the wider estate.

How do I fix "Management ports should be closed on your virtual machines"?

1. Enable just-in-time (JIT) VM access in Microsoft Defender for Cloud for the affected machines. JIT keeps the management ports closed via a deny rule and only opens them to a requesting user's IP for a short, audited window, which clears the recommendation without you having to remember to re-close anything.
2. If JIT is not available (it needs Defender for Servers Plan 2), tighten the NSG rule directly: change the inbound rule for 3389/22 from an Any or Internet source to a specific admin IP or range, for example 'az network nsg rule update --source-address-prefixes 203.0.113.0/24'. Better still, remove the public rule entirely and reach the VM over Azure Bastion or a private link.
3. Bake the closed-by-default posture into your Bicep or Terraform so new VMs never ship with an open management port, and assign the built-in Azure Policy 'Management ports of virtual machines should be protected with just-in-time network access control' to keep the estate compliant by default.

# 1. Close the highest-impact exposure first: delete any rule that
#    allows a management port from the whole internet.
for rule in $(az network nsg rule list -g prod-rg --nsg-name prod-nsg \
    --query "[?access=='Allow' && (sourceAddressPrefix=='*' || sourceAddressPrefix=='Internet') && (destinationPortRange=='3389' || destinationPortRange=='22')].name" -o tsv); do
  az network nsg rule delete -g prod-rg --nsg-name prod-nsg -n "$rule"
  echo "$rule: open management-port rule removed"
done

# 2. Add an explicit deny on the management ports as a backstop.
az network nsg rule create -g prod-rg --nsg-name prod-nsg \
  --name deny-mgmt-ports --priority 4000 --access Deny --direction Inbound \
  --protocol Tcp --source-address-prefixes Internet \
  --destination-port-ranges 22 3389

# 3. Gate the ports you still need behind just-in-time access.
#    JIT is configured via PowerShell or the portal; request access with the CLI:
az security jit-policy list -o table   # confirm the JIT policy is in place

# 4. Ratchet it shut: audit any VM left without an NSG (Defender built-in policy).
az policy assignment create \
  --name audit-internet-facing-nsg \
  --policy f6de0be7-9a8a-4b8a-b349-43cf02d22f7c \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"