Forum Discussion
Removing Inbound port rule in NSG not blocking traffic
Microsoft
an already established RDP connection to a VM will not be impacted by removing an Allow rule or creating a Deny rule. As stated in the documentation, traffic flows are interrupted when connections are stopped and no traffic is flowing in either direction, for at least a few minutes. If you tried to open a new RDP connection with the Deny rule in place, that connection would normally be blocked.
sadly I must have missed that part in the documentation, thanks for pointing it out to me! Do you see another option to lock out an an administrative access with immediate effect, ie. without waiting for the set JIT window to expire?
- hspinto
what you want to accomplish can be done from within the OS. For example, you could trigger an automated that would forcefully logoff all active sessions.
Another option could also be using JIT integrated with Azure Firewall. Unlike NSGs, Azure Firewall drops existing sessions impacted by rule changes. More details here.
- great, thanks for the hint to use JIT with the firewall!
