Inbound Port Rule resets everyday at 9:00am EST

Question

Everyday at 9:02am EST within the Network Settings our Inbound Port Rules will reset automatically causing our remote users issues with remoting into the virtual machine. A 'Microsoft Defender for Cloud' rule will automatically appear at the top of the priority list and reset the priority on an RDP rule that we have setup. Is there a setting or a way to prevent that rule from resetting itself and causing issues for my remote users?

Answer 1

@Jamison Ballou

It sounds like the Just-In-Time (JIT) policy in Microsoft Defender for Cloud might be causing the issue. Here are a few steps you can take to prevent the rule from resetting:

1. Remove JIT Access: Navigate to Microsoft Defender for Cloud -> Workload protection -> Just in time access -> Configured. Select the VM and remove it from the configuration.
2. Delete JIT Policy via API: If the JIT policy persists, you can delete it using the Azure portal API playground. List all the JIT policies under your subscription and delete the one associated with your VM.
3. Adjust Network Security Group (NSG) Rules: Ensure that your NSG rules have higher priority than the JIT policy. This might help in preventing the automatic reset.

These steps should help in preventing the automatic reset of your Inbound Port Rules. If you need more detailed instructions, you can find them here.

Let me know if you need further assistance.

See: https://techcommunity.microsoft.com/discussions/azure/disable-auto-port-blocking-of-unwanted-jit-policy/3946354