Question

A financial services company runs 200 Windows and Linux VMs in Azure hosting sensitive workloads. Administrators currently connect to these VMs via RDP and SSH over public IP addresses with ports left permanently open, which auditors flagged as a management-plane exposure risk. The security architect must reduce the attack surface for administrative access while retaining the ability for approved admins to connect on demand and generate an audit trail of each access request. Which design should the architect recommend?

Accepted Answer

Enable Microsoft Defender for Servers and configure just-in-time (JIT) VM access so management ports are closed by default and opened only for approved, time-bound requests that are logged.

Answer

Deploy a site-to-site VPN gateway and require all administrators to connect through it before initiating RDP or SSH sessions to the VMs.

Answer

Assign the Virtual Machine Contributor role through Privileged Identity Management (PIM) so administrative RDP/SSH sessions require activation and approval.

Answer

Apply Azure Policy to enforce network security group rules that permit RDP and SSH only from the corporate on-premises IP address range.