Azure Compliance ControlsAzure Virtual Machines
Virtual machines should use just-in-time network access control for management ports
Management ports of virtual machines should be protected with just-in-time network access control. Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations. Prowler checks that VMs have a JIT policy.
What this control checks
Checks that virtual machines use just-in-time access control for management ports
Framework mappings
The clauses this control is mapped to in each framework.
- AC-2(12) Account Monitoring for Atypical Usage
- AC-4(3) Dynamic Information Flow Control
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
RBI Cyber Security Framework for UCBs
- Annex I (7.3)
- 1.1 IT Governance
- 3.1.c Role based Access Control
- IAM-08.02B Authentication credentials are managed with a security level that matches or exceeds the classification of the system component they protect.
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- AC-2(12) Account Monitoring
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SC-7(3) Access Points
- 0858.09m1Organizational.4-09.m 09.06 Network Security Management
- 1119.01j2Organizational.3-01.j 01.04 Network Access Control
- 1175.01j1Organizational.8-01.j 01.04 Network Access Control
- 1179.01j3Organizational.1-01.j 01.04 Network Access Control
- 1192.01l1Organizational.1-01.l 01.04 Network Access Control
1 more clause
- 11180.01c3System.6-01.c 01.02 Authorized Access to Information Systems
Related controls
- Network security groups should limit inbound TCP port 5900 access from the internet
- Network security groups should limit inbound TCP port 5500 access from the internet
- Microsoft Entra ID users with VM access should have multifactor authentication enabled
- Linux machines should require passwords for all accounts
- Azure subscriptions should have email notifications for high severity alerts enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_jit_access_protected - Powerpipe Control:
azure_compliance.control.compute_vm_jit_access_protected - Prowler Check:
vm_jit_access_enabled
Last reviewed: 2026-10-11