Just-in-time VM access with Defender for Cloud

JIT rarely fails with an error. It fails quietly, which is worse.

1Break it: the request for the wrong IP

A colleague requests access with the office IP while you work from home:

$req = @{ virtualMachines = @(@{ id = $vmId; ports = @(@{ number = 22; duration = 'PT1H'; allowedSourceAddressPrefix = '203.0.113.10' }) }); justification = 'Lesson 28 test' }
$req | ConvertTo-Json -Depth 6 | Set-Content -Path C:\azure-lab\jit-request.json
az rest --method post --url "${jit}/initiate?api-version=2020-01-01" --body '@C:\azure-lab\jit-request.json' --query "virtualMachines[0].ports[0].{port:number, source:allowedSourceAddressPrefix, status:status}" -o table
Start-Sleep -Seconds 60
az network nsg rule list --resource-group rg-saat-core --nsg-name nsg-saat-web --query "[?access=='Allow' && destinationPortRange=='22'].sourceAddressPrefix" -o tsv

You should see something like this:

Port    Source         Status
------  -------------  ---------
22      203.0.113.10   Initiated
49.36.x.x
203.0.113.10

The request “worked”, and Defender shows it as approved. But if your first request had expired, your laptop would get False from Test-NetConnection: the allow rule is for an address you aren’t using. Home internet IPs also change, sometimes several times a day, which causes the same “JIT is broken” ticket.

Fix it: always request with your current public IP (the portal’s “My IP” option does this), and check what the server sees:

$ip = Invoke-RestMethod -Uri https://api.ipify.org
$req = @{ virtualMachines = @(@{ id = $vmId; ports = @(@{ number = 22; duration = 'PT1H'; allowedSourceAddressPrefix = $ip }) }); justification = 'Lesson 28 test' }
$req | ConvertTo-Json -Depth 6 | Set-Content -Path C:\azure-lab\jit-request.json
az rest --method post --url "${jit}/initiate?api-version=2020-01-01" --body '@C:\azure-lab\jit-request.json' --query "virtualMachines[0].ports[0].{port:number, source:allowedSourceAddressPrefix, status:status}" -o table

2Break it: the old rule that makes JIT useless

Someone adds a “temporary” rule to fix a vendor issue, and forgets it:

az network nsg rule create --resource-group rg-saat-core --nsg-name nsg-saat-web --name tmp-vendor-ssh --priority 150 --direction Inbound --access Allow --protocol Tcp --source-address-prefixes Internet --destination-port-ranges 22 -o none
az network nsg rule list --resource-group rg-saat-core --nsg-name nsg-saat-web --query "[?destinationPortRange=='22'].{name:name, access:access, source:sourceAddressPrefix, priority:priority}" -o table

You should see something like this:

Name                                           Access    Source        Priority
---------------------------------------------  --------  ------------  ----------
tmp-vendor-ssh                                 Allow     Internet      150
SecurityCenter-JITRule-1347516193-B4FC8A3BAB   Allow     49.36.x.x     100
SecurityCenter-JITRule-...                     Allow     203.0.113.10  101
SecurityCenter-JITRule-1347516193-B4FC8A3BAB   Deny      *             4096

Priority 150 sits far above JIT’s deny at 4096, so port 22 is open to the whole internet whether anyone requests access or not. Defender doesn’t delete rules it didn’t create; its recommendations will flag the open port, but JIT itself looks fine.

Fix it: delete the rule, and look for any other allow rule on JIT ports:

az network nsg rule delete --resource-group rg-saat-core --nsg-name nsg-saat-web --name tmp-vendor-ssh
az network nsg rule list --resource-group rg-saat-core --nsg-name nsg-saat-web --query "[?destinationPortRange=='22' && access=='Allow' && !contains(name, 'JIT')].name" -o tsv

The last command prints nothing: only JIT controls port 22 again.

Clean up: remove the JIT policy, the public IP and the Defender plan, then stop web01:

az rest --method delete --url "${jit}?api-version=2020-01-01"
az network nic ip-config update --ids $ipc --remove publicIPAddress -o none
az network public-ip delete --resource-group rg-saat-vms --name pip-web01-tmp
az security pricing create --name VirtualMachines --tier Free -o none
az vm deallocate --resource-group rg-saat-vms --name web01
az network nsg rule list --resource-group rg-saat-core --nsg-name nsg-saat-web --query "[?contains(name, 'JIT')].name" -o tsv
C:\azure-lab\Find-LabResources.ps1 -Lesson 28

You should see this (the rule list may take a minute to empty):

Nothing tagged course=saatvedha-azure is left.

✅ Checkpoint: No JIT rules, no public IP and no tmp rule remain, Defender for Servers is back on Free, and web01 is deallocated.