azure-bastion-jit

Name: azure-bastion-jit
Author: vinayaklatthe

161stars34forks

How to install azure-bastion-jit?

vinayaklatthe/microsoft-security-skills/azure-bastion-jit

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-bastion-jit

Installs into the current project.

Summary

Guidance for secure remote VM management in Azure using Azure Bastion combined with Defender for Cloud just-in-time (JIT) VM access. Covers Bastion SKU selection (Developer / Basic / Standard / Premium), IP-based and shareable-link connections, native client (RDP/SSH from local m

Files · 1

View on GitHub

SKILL.md

1	# Azure Bastion + Just-In-Time VM Access
2
3	The combination of Azure Bastion (managed, browser/native-client jump service) and
4	Defender for Cloud just-in-time (JIT) VM access (time-limited NSG allow-rules for
5	management ports) eliminates the two most common Azure VM compromise paths:
6	internet-exposed RDP/SSH and standing-open management ports.
7
8	## When to use
9	Designing or hardening administrative access to Azure IaaS VMs and VMSS. Use this skill
10	for SKU selection, JIT policy, public-IP elimination, and the operational workflow.
11
12	Do not use this skill for hybrid VPN/SD-WAN design, ZTNA replacement of VPN
13	(`entra-global-secure-access`), or AKS-only access.
14
15	## Bastion SKUs — pick by feature need
16
17	\| SKU \| Capabilities \|
18	\|---\|---\|
19	\| Developer \| Free, ad-hoc, browser-only RDP/SSH to a single VM, single VNet, no scale, no shareable links \|
20	\| Basic \| RDP/SSH via portal, private-IP-only VMs supported, single-instance scale \|
21	\| Standard \| + Native client, shareable links, IP-based connection, Kerberos, Linux file copy, custom port, scale up to 50 instances \|
22	\| Premium \| + Session recording, private-only deployment, additional admin features \|
23
24	> Rule of thumb: Standard for most enterprise; Premium where session recording or
25	> private-only deployment is required (regulated industries). Developer is for
26	> non-production / sandbox personal use.
27
28	## Approach
29
30	1. Architecture. One Bastion per hub VNet (or per spoke if traffic isolation
31	requires). Required subnet: `AzureBastionSubnet` /26 minimum. NSG on the subnet
32	follows the documented allow rules — don't write "deny all from internet" without
33	the documented allow exceptions or Bastion breaks.
34
35	2. Eliminate VM public IPs. Azure Policy: *Public IP addresses should not be
36	associated with virtual machines* — set to Deny in production scopes. New VMs are
37	private-only; admin access is via Bastion + JIT.
38
39	3. Bastion + Entra login on the VM. Combine with `Microsoft Entra login for
40	Windows/Linux VM` extension so RDP/SSH authenticates with Entra credentials,
41	honoring Conditional Access (MFA, device compliance, named locations) on the VM
42	sign-in itself. This is the missing leg most "Bastion-only" deployments forget.
43
44	4. Configure JIT for every VM that's allowed RDP/SSH.
45	- Default ports: RDP 3389, SSH 22, WinRM 5985/5986.
46	- Max request window: 3 hours.
47	- Source: Requestor's IP (or Bastion subnet, since requests come from there).
48	- Approval: implicit by RBAC, or add a manual approval step for tier-0 VMs.
49
50	5. RBAC on Bastion connect. Bastion connect is not the same as VM RBAC. Required
51	roles:
52	- `Reader` on the Bastion + the VM + its NIC + its VNet.
53	- `Virtual Machine User Login` (Linux) / `Virtual Machine Administrator Login`
54	for Entra-based VM sign-in.
55	- JIT request: `Microsoft.Security/locations/jitNetworkAccessPolicies/initiate/action`.
56	Bake into a custom role per persona to avoid over-granting.
57
58	6. Native client + IP-based + shareable links (Standard+).
59	- Native client (`az network bastion rdp/ssh`): admins use local mstsc/SSH
60	tooling; better UX than browser tab. CA still applies via VM sign-in.
61	- IP-based connection: Bastion to peered on-prem VMs over ExpressRoute/VPN.
62	- Shareable links: time-bound URL for break-glass to a contractor. Disable
63	unless explicitly needed; audit usage.
64
65	7. Session recording (Premium). Records video of administrator sessions to a Log
66	Analytics workspace / Storage. Required for some regulated industries; review
67	retention and access controls.
68
69	8. JIT request workflow. Document for admins:
70	- Open Defender for Cloud → JIT VM access → Request access → port + window.
71	- Connect via Bastion within window.
72	- NSG rules auto-revert on expiry.
73
74	9. Monitor. Stream Bastion diagnostic logs

People who liked this also viewed

6 picks

Type

azure-bastion-jit

161stars34forks

View on GitHub

How to install azure-bastion-jit?

vinayaklatthe/microsoft-security-skills/azure-bastion-jit

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-bastion-jit

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Azure Bastion + Just-In-Time VM Access
2
3	The combination of Azure Bastion (managed, browser/native-client jump service) and
4	Defender for Cloud just-in-time (JIT) VM access (time-limited NSG allow-rules for
5	management ports) eliminates the two most common Azure VM compromise paths:
6	internet-exposed RDP/SSH and standing-open management ports.
7
8	## When to use
9	Designing or hardening administrative access to Azure IaaS VMs and VMSS. Use this skill
10	for SKU selection, JIT policy, public-IP elimination, and the operational workflow.
11
12	Do not use this skill for hybrid VPN/SD-WAN design, ZTNA replacement of VPN
13	(`entra-global-secure-access`), or AKS-only access.
14
15	## Bastion SKUs — pick by feature need
16
17	\| SKU \| Capabilities \|
18	\|---\|---\|
19	\| Developer \| Free, ad-hoc, browser-only RDP/SSH to a single VM, single VNet, no scale, no shareable links \|
20	\| Basic \| RDP/SSH via portal, private-IP-only VMs supported, single-instance scale \|
21	\| Standard \| + Native client, shareable links, IP-based connection, Kerberos, Linux file copy, custom port, scale up to 50 instances \|
22	\| Premium \| + Session recording, private-only deployment, additional admin features \|
23
24	> Rule of thumb: Standard for most enterprise; Premium where session recording or
25	> private-only deployment is required (regulated industries). Developer is for
26	> non-production / sandbox personal use.
27
28	## Approach
29
30	1. Architecture. One Bastion per hub VNet (or per spoke if traffic isolation
31	requires). Required subnet: `AzureBastionSubnet` /26 minimum. NSG on the subnet
32	follows the documented allow rules — don't write "deny all from internet" without
33	the documented allow exceptions or Bastion breaks.
34
35	2. Eliminate VM public IPs. Azure Policy: *Public IP addresses should not be
36	associated with virtual machines* — set to Deny in production scopes. New VMs are
37	private-only; admin access is via Bastion + JIT.
38
39	3. Bastion + Entra login on the VM. Combine with `Microsoft Entra login for
40	Windows/Linux VM` extension so RDP/SSH authenticates with Entra credentials,
41	honoring Conditional Access (MFA, device compliance, named locations) on the VM
42	sign-in itself. This is the missing leg most "Bastion-only" deployments forget.
43
44	4. Configure JIT for every VM that's allowed RDP/SSH.
45	- Default ports: RDP 3389, SSH 22, WinRM 5985/5986.
46	- Max request window: 3 hours.
47	- Source: Requestor's IP (or Bastion subnet, since requests come from there).
48	- Approval: implicit by RBAC, or add a manual approval step for tier-0 VMs.
49
50	5. RBAC on Bastion connect. Bastion connect is not the same as VM RBAC. Required
51	roles:
52	- `Reader` on the Bastion + the VM + its NIC + its VNet.
53	- `Virtual Machine User Login` (Linux) / `Virtual Machine Administrator Login`
54	for Entra-based VM sign-in.
55	- JIT request: `Microsoft.Security/locations/jitNetworkAccessPolicies/initiate/action`.
56	Bake into a custom role per persona to avoid over-granting.
57
58	6. Native client + IP-based + shareable links (Standard+).
59	- Native client (`az network bastion rdp/ssh`): admins use local mstsc/SSH
60	tooling; better UX than browser tab. CA still applies via VM sign-in.
61	- IP-based connection: Bastion to peered on-prem VMs over ExpressRoute/VPN.
62	- Shareable links: time-bound URL for break-glass to a contractor. Disable
63	unless explicitly needed; audit usage.
64
65	7. Session recording (Premium). Records video of administrator sessions to a Log
66	Analytics workspace / Storage. Required for some regulated industries; review
67	retention and access controls.
68
69	8. JIT request workflow. Document for admins:
70	- Open Defender for Cloud → JIT VM access → Request access → port + window.
71	- Connect via Bastion within window.
72	- NSG rules auto-revert on expiry.
73
74	9. Monitor. Stream Bastion diagnostic logs

People who liked this also viewed

6 picks

Type