Skip to content

Securely Allow Administrative Access to an Azure VM

Securely Allow Administrative Access to an Azure VM

For VM administration, prefer a design that does not expose RDP (3389) or SSH (22) directly to the internet. Microsoft recommends options such as Azure Bastion, Point-to-Site VPN and Just-in-Time (JIT) access depending on the requirement.

Preferred options

  • Azure Bastion: administer VMs without a public IP on the VM.
  • Point-to-Site VPN: give authorised administrators private network access to VNet resources.
  • JIT VM access: temporarily opens a management port for an approved source and time window when a public-IP design must remain.

If you must use an NSG rule temporarily

  1. Identify the administrator’s current public source IP.
  2. Create an inbound rule only for that single source, for example documentation address 203.0.113.10/32.
  3. Allow only the required management port and only to the target VM/subnet scope needed.
  4. Set a clear ticket/change reference and remove the rule when work is complete.

Never create an RDP or SSH rule from 0.0.0.0/0. Do not expose SMB/445 to the public internet as an administration shortcut.

Reference: Microsoft Learn – Developer and admin access to Azure VMs.