Can I use Just in time access without public IP?

Question

Hello.
I would like to implement Just in time access to my organization.
VM has private IP but no public IP.
Is it required to have public IP to the VM?

Answer 1

Hi @Jay Sachapara

Thanks for reaching out to Microsoft Q & A Platform .

To answer your question, Yes we can enable JIT access to the Private VM's as well who doesn't have the public ip associated to it .

Navigate to configuration tab and from menu and enable the JIT on the VM.
Once it is enabled you should be able to view the functional working also you should see the new NSG's which are created , For example check the following:

Hope this answers your question

Thanks,
Pradeep

---------------------------------------------------------------------------------------------

Please don't forget to "Accept the answer " or "Up-Vote" if this was helpful .

Answer 2

Thank you for the response.
I have enabled JIT and requested access as well but when I download RDP file and tries to connect it give me an error.
This is a brand new tenant and I only have one VM with no public IP.

Answer 3

Hello @Jay Sachapara ,

In addition to what my peer @Pradeep Kommaraju , has suggested I would like you to refer to the azure bastion documentation here
How to configure azure bastion
How to connect to a Windows VM
To connect to a Linux VM

(If any of the responses were helpful please don't forget to upvote and/or accept as answer, thank you)

Answer 4

Just in Time access only works for VM's with Public IP's. What JIT does is open a NSG port for RDP access for the duration of the request, it doesn't do anything else to support access.
Instead, you can make use of Azure Bastion for this, which will provide a jump box as a service for you to connect. You could also combine this with Azure Privilaged Identity Management to perofrm just in time elevation to give rights to use bastion, to give you a JIT process.