> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Just in time access virtual machines remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration of not having Just-In-Time (JIT) access enabled for virtual machines in Azure, you can follow the below steps using Azure Portal: 1. Log in to the Azure Portal ([https://portal.azure.com/](https://portal.azure.com/)). 2. Navigate to the virtual machine for which you want to enable JIT access. 3. From the left-hand side menu, select "Security + networking". 4. Under the "Security" section, select "Just-in-time VM access". 5. On the Just-in-time VM access page, click on "Enable JIT on VM". 6. In the "Basic settings" section, select the "On" radio button to enable JIT access. 7. In the "Advanced settings" section, configure the following settings: * Maximum JIT access time: Set the maximum time for which the JIT access request will be valid. * Ports: Select the ports that you want to open for JIT access. * IP address: Select the IP address range from which you want to allow JIT access. 8. Click on the "Review + create" button to review the JIT access settings. 9. Once you have reviewed the settings, click on the "Create" button to enable JIT access for the virtual machine. Once JIT access is enabled, users can request access to the virtual machine by clicking on the "Request access" button on the Just-in-time VM access page. The request will be reviewed and approved by an authorized user before access is granted. # To enable Just-In-Time (JIT) Access for Virtual Machines in Azure using Azure CLI, follow these steps: 1. Open the Azure CLI in your preferred terminal or command prompt. 2. Run the following command to enable JIT access for the virtual machine: ``` az vm update --resource-group --name --set "Microsoft.Compute/virtualMachines/extensions=JitAccess" ``` Note: Replace `` with the name of your resource group and `` with the name of your virtual machine. 3. After running the command, you will receive a JSON output containing the updated information about your virtual machine. 4. Verify that JIT access has been enabled for the virtual machine by going to the Azure portal and checking the virtual machine's "Security" settings. You should see "JIT VM access" enabled for the virtual machine. That's it! JIT access has now been enabled for your virtual machine in Azure using Azure CLI. To remediate the misconfiguration "Enable Just-In-Time Access for Virtual Machines" in AZURE using Python, you can follow the below steps: 1. Import the required libraries: ```python theme={null} from azure.mgmt.network import NetworkManagementClient from azure.mgmt.resource import ResourceManagementClient from azure.identity import AzureCliCredential ``` 2. Authenticate and create the client object: ```python theme={null} credential = AzureCliCredential() subscription_id = '' resource_client = ResourceManagementClient(credential, subscription_id) network_client = NetworkManagementClient(credential, subscription_id) ``` 3. Get the resource group and virtual machine name: ```python theme={null} resource_group_name = '' vm_name = '' ``` 4. Get the virtual machine object: ```python theme={null} vm = compute_client.virtual_machines.get(resource_group_name, vm_name) ``` 5. Create the JIT access policy object: ```python theme={null} from azure.mgmt.network.models import (SecurityRuleAccess, SecurityRuleDirection, SecurityRuleProtocol, SecurityRule) from datetime import datetime, timedelta start_time = datetime.utcnow() end_time = start_time + timedelta(minutes=30) jit_access_policy = SecurityRule( access=SecurityRuleAccess.allow, description='JIT Access Policy', destination_address_prefix='*', destination_port_range='22', direction=SecurityRuleDirection.inbound, name='JIT Access Policy', priority=500, protocol=SecurityRuleProtocol.tcp, source_address_prefix='*', source_port_range='*', provisioning_state='Succeeded', start_time=start_time, end_time=end_time ) ``` 6. Add the JIT access policy to the virtual machine network security group: ```python theme={null} nsg_name = vm.network_profile.network_interfaces[0].network_security_group.id.split('/')[-1] nsg = network_client.network_security_groups.get(resource_group_name, nsg_name) nsg.security_rules.append(jit_access_policy) network_client.security_rules.create_or_update(resource_group_name, nsg_name, jit_access_policy.name, jit_access_policy) ``` 7. Save the changes: ```python theme={null} nsg = network_client.network_security_groups.create_or_update(resource_group_name, nsg_name, nsg) ``` This will enable JIT access for the virtual machine in Azure. ```hcl theme={null} resource "azurerm_linux_virtual_machine" "VM" { name = "VM_NAME" # substitute with your VM name resource_group_name = "RESOURCE_GROUP_NAME" # substitute with your resource group location = "LOCATION" # e.g. "eastus" size = "Standard_DS1_v2" admin_username = "ADMIN_USERNAME" network_interface_ids = [ azurerm_network_interface.VM_NIC.id, ] os_disk { caching = "ReadWrite" storage_account_type = "Standard_LRS" } source_image_reference { publisher = "Canonical" offer = "0001-com-ubuntu-server-focal" sku = "20_04-lts" version = "latest" } admin_ssh_key { username = "ADMIN_USERNAME" public_key = file("PATH_TO_PUBLIC_KEY") # substitute with your SSH public key path } } resource "azurerm_security_center_just_in_time_network_access_policy" "VM_JIT" { name = "VM_JIT_POLICY_NAME" # e.g. "jit-policy-vm-name" resource_group_name = "RESOURCE_GROUP_NAME" # must match the VM's resource group location = "LOCATION" # same region as the VM (e.g. "eastus") virtual_machines { id = azurerm_linux_virtual_machine.VM.id # Open only the ports you intend to protect with JIT (example: SSH) ports { number = 22 # port to protect (e.g. 22 for SSH, 3389 for RDP) protocol = "Tcp" # Restrict who can request JIT access (example: single admin IP) allowed_source_address_prefixes = [ "ADMIN_PUBLIC_IP/32", # substitute with the allowed admin IP/CIDR ] # Maximum allowed JIT window per request (example: 3 hours) max_request_access_duration = "PT3H" # substitute threshold as needed, ISO 8601 (e.g. PT1H, PT4H) } } } ``` This change does not force replacement of the existing virtual machine; it adds a separate Security Center JIT policy resource that governs on-demand access to the VM’s network ports. For verification, `terraform plan` should show creation of `azurerm_security_center_just_in_time_network_access_policy.VM_JIT` with the specified `virtual_machines`/`ports` configuration and no changes requiring replacement of `azurerm_linux_virtual_machine.VM`.