JIT VM Access License for AVD Session Hosts
You have an Azure Virtual Desktop deployment. You plan to use just-in-time (JIT) VM access to manage session host virtual machines. You need to recommend license requirements for JIT VM access. Your solution must minimize costs. Which license should you recommend?
Community Votes
75% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of licensing requirements for Just-In-Time (JIT) VM access; the common trap is assuming the cheaper Defender for Servers Plan 1 includes this feature.
Just-In-Time (JIT) VM access for Azure Virtual Desktop session hosts requires a specific Microsoft Defender for Cloud license. This page establishes that Microsoft Defender for Servers Plan 2 is the minimum license needed to enable JIT.
Choosing Microsoft Defender for Servers Plan 1 because it is cheaper, even though it does not include the JIT VM access feature.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Microsoft Defender for Servers Plan 2 is the correct recommendation because it is the lowest-tier license that includes the Just-In-Time (JIT) VM access feature. While the question requires minimizing costs, Plan 1 does not support JIT, making Plan 2 the minimum necessary license to fulfill the requirement. This plan provides the specific security control needed to lock down management ports on the session hosts.Why the Other Options Are Wrong
Enterprise Mobility + Security E5 and Microsoft 365 E5 do not include Microsoft Defender for Servers Plan 2, which is required for JIT VM access on Azure VMs. Microsoft Defender for Servers Plan 1 is cheaper than Plan 2, but it lacks the JIT VM access feature entirely, so it cannot be used to meet the requirement. Choosing any of these would either fail to enable the feature or unnecessarily increase costs without meeting the core technical need.Community Comment Notes
Several community members correctly pointed out that Microsoft Defender for Servers Plan 2 is required, with one explicitly stating "That is the lowest‐cost Defender plan that includes JIT VM access as a feature". Another user mistakenly chose Plan 1 based on the "minimize costs" constraint, assuming it included JIT, which highlights a common misunderstanding of the plan features.Official Reference
Exam Strategy
When asked about licensing for specific Defender for Cloud features, recall that advanced features like Just-In-Time (JIT) VM access are gated behind Plan 2, not Plan 1. Do not let the 'minimize costs' phrase trick you into choosing a lower-tier plan that lacks the required feature.
Related Analysis
Practice All AZ-140 Questions
Access 64 questions with complete answers and detailed explanations.
View Full AZ-140 Practice Test →