A supported VM is covered by Defender for Servers Plan 2. An authorized administrator needs RDP from one approved source IP for one hour, with the network opening closed afterward. Which approach implements the requirement?

✓ Correct answer

• Configure JIT protection for the required port and approved source/time window, then submit an authorized access request.

JIT with the supported Plan 2/topology temporarily opens managed network rules for the approved source, ports, and duration. Guest credentials and network reachability remain separate prerequisites. Option explanations: A. Create a permanent NSG allow for TCP 3389 from all internet addresses.: A permanent internet-wide rule does not restrict the source or expire after the approved hour. B. Configure JIT protection for the required port and approved source/time window, then submit an authorized access request.: JIT configuration and the approved request produce the required temporary managed opening. C. Grant Virtual Machine Contributor and assume it creates a timed RDP opening.: A compute management role does not create the requested JIT network window. D. Use Defender for Servers Plan 1 as a substitute for the stated JIT plan requirement.: The documented JIT feature requires Defender for Servers Plan 2. Sources: Enable just-in-time VM access — https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage

Read the source reference