JIT VM Access License for AVD Session Hosts

AZ-140 Last updated

Plan and implement security

Short answer

D Recommend Microsoft Defender for Servers Plan 2 to enable Just-In-Time (JIT) VM access while minimizing costs.

Question

You have an Azure Virtual Desktop deployment. You plan to use just-in-time (JIT) VM access to manage session host virtual machines. You need to recommend license requirements for JIT VM access. Your solution must minimize costs. Which license should you recommend?

  1. Enterprise Mobility + Security E5
  2. Microsoft 365 E5
  3. Microsoft Defender for Servers Plan 1
  4. Microsoft Defender for Servers Plan 2 Correct Answer

Key Takeaways

The question tests knowledge of licensing requirements for Just-In-Time (JIT) VM access; the common trap is assuming the cheaper Defender for Servers Plan 1 includes this feature.

Just-In-Time (JIT) VM access for Azure Virtual Desktop session hosts requires a specific Microsoft Defender for Cloud license. This page establishes that Microsoft Defender for Servers Plan 2 is the minimum license needed to enable JIT.

Common mistake: Choosing Microsoft Defender for Servers Plan 1 because it is cheaper, even though it does not include the JIT VM access feature.

Expert Analysis

Why the Answer Is Correct

Microsoft Defender for Servers Plan 2 is the correct recommendation because it is the lowest-tier license that includes the Just-In-Time (JIT) VM access feature. While the question requires minimizing costs, Plan 1 does not support JIT, making Plan 2 the minimum necessary license to fulfill the requirement. This plan provides the specific security control needed to lock down management ports on the session hosts.

Why the Other Options Are Wrong

Enterprise Mobility + Security E5 and Microsoft 365 E5 do not include Microsoft Defender for Servers Plan 2, which is required for JIT VM access on Azure VMs. Microsoft Defender for Servers Plan 1 is cheaper than Plan 2, but it lacks the JIT VM access feature entirely, so it cannot be used to meet the requirement. Choosing any of these would either fail to enable the feature or unnecessarily increase costs without meeting the core technical need.

Community Comment Notes

Several community members correctly pointed out that Microsoft Defender for Servers Plan 2 is required, with one explicitly stating "That is the lowest‐cost Defender plan that includes JIT VM access as a feature". Another user mistakenly chose Plan 1 based on the "minimize costs" constraint, assuming it included JIT, which highlights a common misunderstanding of the plan features.

Official Reference

Exam Strategy

When asked about licensing for specific Defender for Cloud features, recall that advanced features like Just-In-Time (JIT) VM access are gated behind Plan 2, not Plan 1. Do not let the 'minimize costs' phrase trick you into choosing a lower-tier plan that lacks the required feature.

Community Votes

D
75%
C
25%

75% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.

From public community threads 5

  1. db7a78f 👍 4
    Correct https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage
  2. jeff1988 👍 1 Answered D
    D. Microsoft Defender for Servers Plan 2. Microsoft Defender for Servers Plan 2 includes the JIT VM access feature, which allows you to manage and secure your session host virtual machines effectively12. This plan provides comprehensive security features, including JIT access, making it the most suitable choice for your needs.
  3. hwoccurrence 👍 1 Answered D
    You need Microsoft Defender for Servers Plan 2 if you want to enable Just‐in‐Time (JIT) VM access on Azure VMs. That is the lowest‐cost Defender plan that includes JIT VM access as a feature. https://learn.microsoft.com/nb-no/azure/defender-for-cloud/plan-defender-for-servers-select-plan
  4. Kimyunyung 👍 1 Answered C
    I think C is closer to the answer than D The minimum cost was recommended, so considering the low price of Plan 2 and Plan 1, Plan 1 is considered to be a low cost part of JIT.
  5. Moot2 👍 1 Answered D
    Microsoft Defender for Servers Plan 2 if you want to enable Just‐in‐Time (JIT)

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Which Storage Accounts Can Host FSLogix Profile Containers?

S-Grade

First Step for AVD Reauthentication in New Subscription

S-Grade

Does the Owner Role Let Admin1 Assign Scaling1 to Pool1?

S-Grade

Practice All AZ-140 Questions

Access 64 questions with complete answers and detailed explanations.

View Full AZ-140 Practice Test →

← Back to AZ-140 Study Guide