Microsoft Defender for Servers and JIT access
Servers are attacked mainly through open management ports and unpatched software. Microsoft Defender for Servers adds threat detection, vulnerability assessment and port hardening for Windows Server in Azure and on-premises.
What Defender for Servers is
Defender for Servers is a paid plan inside Microsoft Defender for Cloud. It covers Azure VMs and also on-premises or other-cloud servers once they are Azure Arc-enabled. Microsoft Defender for Endpoint is integrated, so the endpoint sensor is deployed to the servers.
| Plan | Highlights |
|---|---|
| Plan 1 | Defender for Endpoint integration, simple per-server pricing |
| Plan 2 | Everything in Plan 1 plus just-in-time VM access, file integrity monitoring, adaptive application controls, network map and agentless scanning |
Older documents say “enhanced security features” for the paid tier. That is the former name of the paid Defender plans.
Where you enable it
You enable the plan at the subscription level in Defender for Cloud (Environment settings), or at the Log Analytics workspace level for workspace-based coverage. You cannot enable it on a single resource group, VNet or VM.
Onboarding on-premises servers
- Install the Azure Connected Machine agent (manually, with a script, or through Group Policy at scale).
- The server appears as an Arc-enabled server in a resource group.
- Defender for Servers and extensions such as Azure Monitor Agent are deployed to it.
Just-in-time VM access
JIT keeps ports such as RDP (3389) and SSH (22) closed in the network security group. When someone needs access:
- The user requests access, specifying port, source IP and duration.
- Azure RBAC is checked (the user needs write rights on the VM).
- A temporary allow rule with a higher priority is added to the NSG (and Azure Firewall if used).
- The rule is removed when the time expires.
JIT works for Azure VMs that have an NSG or are behind Azure Firewall. You configure it from the Defender for Cloud Workload protections page or the VM’s Configuration blade.
Exam traps
- JIT is Plan 2, not Plan 1. If the plan is enabled but JIT is missing, check the plan tier first.
- The plan is turned on for a subscription or workspace, never per VM or per resource group.
- On-premises servers need Azure Arc first. The Azure Migrate appliance is for migration, not protection.
- JIT changes NSG rules, not the Windows Firewall inside the guest.
- Contributor is enough to use many Defender settings but not to change subscription-wide plans, which need Owner or Security Admin.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. You want Microsoft Defender for Servers protection for every VM in a subscription with the least effort. Where do you enable the plan?
Show answer
Answer: B.Defender for Servers is a Defender for Cloud plan that is turned on per subscription (or per Log Analytics workspace). All machines in scope are then covered.
2. An administrator with the Contributor role on a subscription that already has Defender for Servers wants to use just-in-time VM access. What is the missing piece?
Show answer
Answer: A.JIT VM access is a Plan 2 capability. Plan 1 does not include it.
3. An on-premises Windows Server must be protected by Defender for Servers. How do you bring it into Azure?
Show answer
Answer: B.Non-Azure servers are onboarded through Azure Arc. Once the server is an Arc resource, Defender for Cloud can protect it like an Azure VM.
4. What does JIT VM access do when a user requests access to port 3389?
Show answer
Answer: B.JIT keeps management ports closed by default. An approved request adds a time-limited NSG rule for the source address.