Your company has defined a set of virtual machines as part of their subscription. The company currently has Azure P2 Premium licences for their users. They are using the Standard version of Azure…

Question

Options

• AMicrosoft.Security/locations/jitNetworkAccessPolicies/write
• BMicrosoft.Security/locations/jitNetworkAccessPolicies/initiate/action
• CMicrosoft.Compute/virtualMachines/write
• DMicrosoft.Compute/virtualMachines/read

• A
  7% (2)
• B
  74% (20)
• C
  19% (5)

Explanation

Just-In-Time VM Access – RBAC Permissions Explained

To request Just-in-Time (JIT) access to a virtual machine, a user needs two specific permissions: initiate/action (Option B) to actually trigger the JIT access request, and read (Option D) to view and identify the virtual machine they want to connect to. These are the minimum permissions required for a requester role, keeping costs low by avoiding over-provisioned access.

Why the distractors are wrong:

• Option A (jitNetworkAccessPolicies/write) is required to configure or create JIT policies - this is an administrative action needed by someone setting up JIT, not someone requesting access.
• Option C (virtualMachines/write) grants the ability to modify virtual machines, which is far more privilege than needed just to request temporary access - violating the principle of least privilege.

Memory Tip: Think of it as a "See it, Request it" model - you need Read to see the VM and Initiate to request the door to open. Write permissions are for admins who build the policy or modify resources, not for end users knocking on the door.

No community discussion yet for this question.