Cannot remove JIT rules from Defender for Servers

Question

Cannot remove JIT rules from Defender for Servers

ChristianSievers 0

We are using Microsoft Defender for Cloud. We need to turn off a JIT access rule for a particular NSG, however, the delete action never removes the rule. One guidance suggests to turn of Defender for the entire subscription, which we don't want to do.

1 answer

Your answer

Answer 1

VEMULA SRISAI 2,040 Microsoft External Staff Moderator

Hello ChristianSievers,

Thanks for posting your question in the Microsoft Q&A Forum.

Below is the process to remove a Just-in-Time (JIT) VM access policy in Microsoft Defender for Cloud:

Go to the Azure portal → Microsoft Defender for Cloud.

In the left menu, select Workload protection.

Under Advanced protection, select Just-in-time VM access.

Open the Configured tab.

Select the VM(s) you want to remove from JIT protection.

Click Remove to remove the VM from the JIT configuration.

Simply deleting or modifying the NSG rule will not work. JIT has a recovery mechanism that will automatically re-apply the rule as long as the VM is still enrolled.

I hope this information is helpful. If you need additional information or need assistance please let me know.

VEMULA SRISAI 2,040 Reputation points Microsoft External Staff Moderator

2025-09-27T12:12:38.2+00:00

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Catherine Kyalo 2,465 Reputation points Microsoft Employee

2025-11-05T11:45:29.3233333+00:00

Could you share a little bit on why you would want disable the JIT rules

Share via

Cannot remove JIT rules from Defender for Servers

1 answer

Your answer