Removing Inbound port rule in NSG not blocking traffic

[STTHV]

Playing with JIT access to a Windows VM I wanted to close external RDP access prior to JIT time range expiration.

As there does not seem to be a suitable command I tried removing the JIT-generated 3389 allow rule from the NSG associated to both NIC and subnet . While that seemed to succeed with the 3389 deny rule now taking precedence over the default rules as per the attached screenshot, my external RDP connection to the VM kept working without a hitch.

Any idea what I might be missing?

[#2]

@STTHV 

an already established RDP connection to a VM will not be impacted by removing an Allow rule or creating a Deny rule. As stated in the documentation, traffic flows are interrupted when connections are stopped and no traffic is flowing in either direction, for at least a few minutes. If you tried to open a new RDP connection with the Deny rule in place, that connection would normally be blocked.

[#3]

@hspinto 

sadly I must have missed that part in the documentation, thanks for pointing it out to me!  Do you see another option to lock out an an administrative access with immediate effect, ie. without waiting for the set JIT window to expire?

[#4]

@STTHV 

what you want to accomplish can be done from within the OS. For example, you could trigger an automated that would forcefully logoff all active sessions.

Another option could also be using JIT integrated with Azure Firewall. Unlike NSGs, Azure Firewall drops existing sessions impacted by rule changes. More details here.

[#5]

great, thanks for the hint to use JIT with the firewall!