4.2.2. Azure Bastion and Just-In-Time VM Access
💡 First Principle: RDP and SSH ports open to the internet are one of the most common ways VMs get compromised through credential-stuffing and brute-force attacks — Bastion and JIT each address that risk from a different angle, and using both together closes more of the gap than either alone.
Azure Bastion provides browser-based RDP/SSH access to VMs without ever exposing a public IP or those management ports to the internet at all — the connection is proxied through the Bastion service inside the VNet. Just-in-time (JIT) VM access, enforced through Defender for Cloud, takes a different approach: it keeps management ports closed by default and temporarily opens a narrow NSG rule — scoped to a specific source IP and time window — only when an authorized request is approved.
⚠️ Exam Trap: Bastion and JIT solve overlapping but distinct problems — Bastion removes the need for a public IP on the VM at all, while JIT is about time-bounding exposure for VMs that still need a management port reachable (even privately) on demand. A scenario requiring "zero public exposure ever" is a Bastion answer; one requiring "narrow the exposure window" without necessarily removing the public IP is a JIT answer — though production environments commonly use both.
Reflection Question: If a VM already uses Azure Bastion exclusively for access with no public IP at all, does JIT VM access still provide additional value? Why or why not?
