Just-in-time access
Just-in-time access makes a permission or access path available when needed for a limited period, instead of leaving it continuously available.
Ask what becomes available
Just-in-time access can apply to different things. In Microsoft Entra PIM, an eligible user can request a temporary active role assignment. In Defender for Cloud, an approved request can temporarily allow traffic to selected VM management ports from specified addresses.
Those are different controls. Opening a network path does not itself grant an administrator role inside the machine. Activating a role does not, by itself, open every network path to a resource.
The request should match the work: the permission or destination, its scope, and how long it is needed. Approval requirements depend on the implementation and configuration. “Just in time” does not automatically mean a person reviewed each request.
Expiry does not always end an existing session
Entra PIM removes the active role assignment on deactivation or expiry, but Microsoft notes that applications can cache role information and continue allowing access for a time. Defender for Cloud’s documented JIT network behavior also leaves established connections uninterrupted after the approved period expires.
Check what your system actually removes and when the target enforces that change. A timer is not proof that all earlier sessions ended or that changes made during the access window were undone.
The privileged role activation article follows the assignment and the administrative work separately. This use of JIT also differs from just-in-time account provisioning, which creates an account during a sign-in workflow.