Question

Your organization runs an Azure Virtual Desktop personal host pool. Administrators occasionally connect to individual session hosts via RDP (port 3389) for direct troubleshooting, but the security team requires that management ports remain closed by default and are only opened for a limited, approved time window when access is explicitly requested. All session hosts are protected by Microsoft Defender for Cloud (enhanced security features enabled). Which solution meets these requirements with the least administrative effort?

Accepted Answer

Enable Just-in-Time (JIT) VM access in Microsoft Defender for Cloud for the session hosts and require access requests for port 3389.

Answer

Deploy Azure Firewall with an application rule that permanently allows RDP traffic to the session hosts.

Answer

Create an NSG rule that allows inbound port 3389 from the corporate IP range at all times.

Answer

Configure a user-defined route (UDR) that forces RDP traffic through a network virtual appliance.