Virtual machines should use just-in-time network access control for management ports
Management ports of virtual machines should be protected with just-in-time network access control. Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations. Prowler checks that VMs have a JIT policy.
Without JIT, management ports like 22 / 3389 may stay reachable, enabling brute-force and password-spray attempts. Without JIT, management ports like 22 / 3389 may stay reachable, enabling exploitation of remote access flaws or stolen keys. This threatens confidentiality (data exfiltration), integrity (unauthorized changes), and availability (service disruption).
What this control checks
Checks that virtual machines use just-in-time access control for management ports
Audit evidence
Evidence that deployed resources meet this control: Prowler check vm_jit_access_enabled (prowler azure --checks vm_jit_access_enabled); PowerPipe control azure_compliance.control.compute_vm_jit_access_protected.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-2(12) (Account Monitoring for Atypical Usage), AC-4 (Information Flow Enforcement), AC-4(3) (Dynamic Information Flow Control) and 2 more clauses.
NIST Cybersecurity Framework v2.0: Mapped to ID.AM-08 (Systems, hardware, software, services, and data are managed throughout their life cycles.).
Framework mappings
The clauses this control is mapped to in each framework.
- AC-2(12) Account Monitoring for Atypical Usage
- AC-4(3) Dynamic Information Flow Control
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
RBI Cyber Security Framework for UCBs
- Annex I (7.3)
- 1.1 IT Governance
- 3.1.c Role based Access Control
- IAM-08.02B Authentication credentials are managed with a security level that matches or exceeds the classification of the system component they protect.
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- AC-2(12) Account Monitoring
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SC-7(3) Access Points
- 0858.09m1Organizational.4-09.m 09.06 Network Security Management
- 1119.01j2Organizational.3-01.j 01.04 Network Access Control
- 1175.01j1Organizational.8-01.j 01.04 Network Access Control
- 1179.01j3Organizational.1-01.j 01.04 Network Access Control
- 1192.01l1Organizational.1-01.l 01.04 Network Access Control
1 more clause
- 11180.01c3System.6-01.c 01.02 Authorized Access to Information Systems
Related controls
- Network security groups should limit inbound TCP port 5900 access from the internet
- Network security groups should limit inbound TCP port 5500 access from the internet
- Microsoft Entra ID users with VM access should have multifactor authentication enabled
- Linux machines should require passwords for all accounts
- Azure subscriptions should have email notifications for high severity alerts enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_jit_access_protected - Powerpipe Control:
azure_compliance.control.compute_vm_jit_access_protected - Prowler Check:
vm_jit_access_enabled
Last reviewed: 2026-10-11