Rule Details
- Rule ID: AZ-XXX-000
- Severity: MEDIUM
- Category: Compute
- Frameworks: CIS / NIST
What does it detect?
VMs with management ports (22, 3389, etc.) reachable without Microsoft Defender for Cloud
Just-In-Time (JIT) VM access enabled — those ports are open on a standing basis instead of only
during an approved, time-boxed request.
Detection logic
Cross-reference each VM against Defender for Cloud's JIT policies
(Microsoft.Security/locations/jitNetworkAccessPolicies) for the VM's subscription/region. Flag
VMs with management ports open per their NSG rules that have no matching JIT policy covering them.
Why is this a security risk?
Standing-open management ports are continuously scanned and brute-forced — see the real-world
precedent already documented for AZ-NET-001/002 in docs/adding-a-rule.md (SSH/RDP exposed to the
internet). JIT reduces the exposure window to only when access is actively needed and approved.
Remediation steps
Enable JIT VM access in Defender for Cloud for the affected VM and ports, or via
az security jit-policy create.
Test plan
Kept separate from issue 8 because it depends on the Defender for Cloud JIT policy API — a
different collector than the two plain VM-property checks bundled there.
Rule Details
What does it detect?
VMs with management ports (22, 3389, etc.) reachable without Microsoft Defender for Cloud
Just-In-Time (JIT) VM access enabled — those ports are open on a standing basis instead of only
during an approved, time-boxed request.
Detection logic
Cross-reference each VM against Defender for Cloud's JIT policies
(Microsoft.Security/locations/jitNetworkAccessPolicies) for the VM's subscription/region. Flag
VMs with management ports open per their NSG rules that have no matching JIT policy covering them.
Why is this a security risk?
Standing-open management ports are continuously scanned and brute-forced — see the real-world
precedent already documented for AZ-NET-001/002 in docs/adding-a-rule.md (SSH/RDP exposed to the
internet). JIT reduces the exposure window to only when access is actively needed and approved.
Remediation steps
Enable JIT VM access in Defender for Cloud for the affected VM and ports, or via
az security jit-policy create.Test plan
Kept separate from issue 8 because it depends on the Defender for Cloud JIT policy API — a
different collector than the two plain VM-property checks bundled there.