Just in time access virtual machines remediation

Using Console

Using CLI

To enable Just-In-Time (JIT) Access for Virtual Machines in Azure using Azure CLI, follow these steps:

Open the Azure CLI in your preferred terminal or command prompt.
Run the following command to enable JIT access for the virtual machine:

az vm update --resource-group <resource-group-name> --name <vm-name> --set "Microsoft.Compute/virtualMachines/extensions=JitAccess"

Note: Replace <resource-group-name> with the name of your resource group and <vm-name> with the name of your virtual machine.

After running the command, you will receive a JSON output containing the updated information about your virtual machine.
Verify that JIT access has been enabled for the virtual machine by going to the Azure portal and checking the virtual machine’s “Security” settings. You should see “JIT VM access” enabled for the virtual machine.

That’s it! JIT access has now been enabled for your virtual machine in Azure using Azure CLI.

Using Python

To remediate the misconfiguration “Enable Just-In-Time Access for Virtual Machines” in AZURE using Python, you can follow the below steps:

Import the required libraries:

from azure.mgmt.network import NetworkManagementClient
from azure.mgmt.resource import ResourceManagementClient
from azure.identity import AzureCliCredential

Authenticate and create the client object:

credential = AzureCliCredential()
subscription_id = '<subscription_id>'
resource_client = ResourceManagementClient(credential, subscription_id)
network_client = NetworkManagementClient(credential, subscription_id)

Get the resource group and virtual machine name:

resource_group_name = '<resource_group_name>'
vm_name = '<vm_name>'

Get the virtual machine object:

vm = compute_client.virtual_machines.get(resource_group_name, vm_name)

Create the JIT access policy object:

from azure.mgmt.network.models import (SecurityRuleAccess, SecurityRuleDirection, SecurityRuleProtocol, SecurityRule)
from datetime import datetime, timedelta

start_time = datetime.utcnow()
end_time = start_time + timedelta(minutes=30)

jit_access_policy = SecurityRule(
    access=SecurityRuleAccess.allow,
    description='JIT Access Policy',
    destination_address_prefix='*',
    destination_port_range='22',
    direction=SecurityRuleDirection.inbound,
    name='JIT Access Policy',
    priority=500,
    protocol=SecurityRuleProtocol.tcp,
    source_address_prefix='*',
    source_port_range='*',
    provisioning_state='Succeeded',
    start_time=start_time,
    end_time=end_time
)

Add the JIT access policy to the virtual machine network security group:

nsg_name = vm.network_profile.network_interfaces[0].network_security_group.id.split('/')[-1]

nsg = network_client.network_security_groups.get(resource_group_name, nsg_name)
nsg.security_rules.append(jit_access_policy)

network_client.security_rules.create_or_update(resource_group_name, nsg_name, jit_access_policy.name, jit_access_policy)

Save the changes:

nsg = network_client.network_security_groups.create_or_update(resource_group_name, nsg_name, nsg)

This will enable JIT access for the virtual machine in Azure.

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Just in time access virtual machines remediation

Triage and Remediation

Remediation