Microsoft Defender Jit Network Access Policies API

openapi: 3.2.0
info:
  title: Microsoft Defender for Cloud REST API (Microsoft.Security)…
  version: stable-composite
  description: Composite of the latest stable Microsoft.Security resource-manager swagger files published by Microsoft in Azure/azure-rest-api-specs. Each path keeps its own api-version via x-source.
  x-source-repo: https://github.com/Azure/azure-rest-api-specs/tree/main/specification/security/resource-manager/Microsoft.Security/Security
servers:
- url: https://management.azure.com
security:
- azure_auth:
  - user_impersonation
tags:
- name: JitNetworkAccessPolicies
paths:
  /subscriptions/{subscriptionId}/providers/Microsoft.Security/jitNetworkAccessPolicies:
    get:
      operationId: JitNetworkAccessPolicies_List
      tags:
      - JitNetworkAccessPolicies
      description: Policies for protecting resources using Just-in-Time access control.
      parameters:
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JitNetworkAccessPoliciesList'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Common.CloudError'
      x-ms-examples:
        Get JIT network access policies on a subscription:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2020-01-01/examples/JitNetworkAccessPolicies/GetJitNetworkAccessPoliciesSubscription_example.json
      x-ms-pageable:
        nextLinkName: nextLink
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2020-01-01/security-SecuritySolutions.json
      summary: Jit network access policies list
      x-summary-source: derived
  /subscriptions/{subscriptionId}/providers/Microsoft.Security/locations/{ascLocation}/jitNetworkAccessPolicies:
    get:
      operationId: JitNetworkAccessPolicies_ListByRegion
      tags:
      - JitNetworkAccessPolicies
      description: Policies for protecting resources using Just-in-Time access control for the subscription, location
      parameters:
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - name: ascLocation
        in: path
        description: The location where ASC stores the data of the subscription. can be retrieved from Get locations
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JitNetworkAccessPoliciesList'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Common.CloudError'
      x-ms-examples:
        Get JIT network access policies on a subscription from a security data location:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2020-01-01/examples/JitNetworkAccessPolicies/GetJitNetworkAccessPoliciesSubscriptionLocation_example.json
      x-ms-pageable:
        nextLinkName: nextLink
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2020-01-01/security-SecuritySolutions.json
      summary: Jit network access policies list by region
      x-summary-source: derived
  /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/jitNetworkAccessPolicies:
    get:
      operationId: JitNetworkAccessPolicies_ListByResourceGroup
      tags:
      - JitNetworkAccessPolicies
      description: Policies for protecting resources using Just-in-Time access control for the subscription, location
      parameters:
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JitNetworkAccessPoliciesList'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Common.CloudError'
      x-ms-examples:
        Get JIT network access policies on a resource group:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2020-01-01/examples/JitNetworkAccessPolicies/GetJitNetworkAccessPoliciesResourceGroup_example.json
      x-ms-pageable:
        nextLinkName: nextLink
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2020-01-01/security-SecuritySolutions.json
      summary: Jit network access policies list by resource group
      x-summary-source: derived
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/jitNetworkAccessPolicies
  : get:
      operationId: JitNetworkAccessPolicies_ListByResourceGroupAndRegion
      tags:
      - JitNetworkAccessPolicies
      description: Policies for protecting resources using Just-in-Time access control for the subscription, location
      parameters:
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: ascLocation
        in: path
        description: The location where ASC stores the data of the subscription. can be retrieved from Get locations
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JitNetworkAccessPoliciesList'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Common.CloudError'
      x-ms-examples:
        Get JIT network access policies on a resource group from a security data location:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2020-01-01/examples/JitNetworkAccessPolicies/GetJitNetworkAccessPoliciesResourceGroupLocation_example.json
      x-ms-pageable:
        nextLinkName: nextLink
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2020-01-01/security-SecuritySolutions.json
      summary: Jit network access policies list by resource group and region
      x-summary-source: derived
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/jitNetworkAccessPolicies/{jitNetworkAccessPolicyName}
  : get:
      operationId: JitNetworkAccessPolicies_Get
      tags:
      - JitNetworkAccessPolicies
      description: Policies for protecting resources using Just-in-Time access control for the subscription, location
      parameters:
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: ascLocation
        in: path
        description: The location where ASC stores the data of the subscription. can be retrieved from Get locations
        required: true
        schema:
          type: string
      - name: jitNetworkAccessPolicyName
        in: path
        description: Name of a Just-in-Time access configuration policy.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JitNetworkAccessPolicy'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Common.CloudError'
      x-ms-examples:
        Get JIT network access policy:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2020-01-01/examples/JitNetworkAccessPolicies/GetJitNetworkAccessPolicy_example.json
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2020-01-01/security-SecuritySolutions.json
      summary: Jit network access policies get
      x-summary-source: derived
    put:
      operationId: JitNetworkAccessPolicies_CreateOrUpdate
      tags:
      - JitNetworkAccessPolicies
      description: Create a policy for protecting resources using Just-in-Time access control
      parameters:
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: ascLocation
        in: path
        description: The location where ASC stores the data of the subscription. can be retrieved from Get locations
        required: true
        schema:
          type: string
      - name: jitNetworkAccessPolicyName
        in: path
        description: Name of a Just-in-Time access configuration policy.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Resource 'JitNetworkAccessPolicy' update operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JitNetworkAccessPolicy'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Common.CloudError'
      x-ms-examples:
        Create JIT network access policy:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2020-01-01/examples/JitNetworkAccessPolicies/CreateJitNetworkAccessPolicy_example.json
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2020-01-01/security-SecuritySolutions.json
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/JitNetworkAccessPolicy'
        required: true
      summary: Jit network access policies create or update
      x-summary-source: derived
    delete:
      operationId: JitNetworkAccessPolicies_Delete
      tags:
      - JitNetworkAccessPolicies
      description: Delete a Just-in-Time access control policy.
      parameters:
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: ascLocation
        in: path
        description: The location where ASC stores the data of the subscription. can be retrieved from Get locations
        required: true
        schema:
          type: string
      - name: jitNetworkAccessPolicyName
        in: path
        description: Name of a Just-in-Time access configuration policy.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Resource deleted successfully.
        '204':
          description: Resource does not exist.
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Common.CloudError'
      x-ms-examples:
        Delete a JIT network access policy:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2020-01-01/examples/JitNetworkAccessPolicies/DeleteJitNetworkAccessPolicy_example.json
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2020-01-01/security-SecuritySolutions.json
      summary: Jit network access policies delete
      x-summary-source: derived
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/locations/{ascLocation}/jitNetworkAccessPolicies/{jitNetworkAccessPolicyName}/{jitNetworkAccessPolicyInitiateType}
  : post:
      operationId: JitNetworkAccessPolicies_Initiate
      tags:
      - JitNetworkAccessPolicies
      description: Initiate a JIT access from a specific Just-in-Time policy configuration.
      parameters:
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: ascLocation
        in: path
        description: The location where ASC stores the data of the subscription. can be retrieved from Get locations
        required: true
        schema:
          type: string
      - name: jitNetworkAccessPolicyName
        in: path
        description: Name of a Just-in-Time access configuration policy.
        required: true
        schema:
          type: string
      - name: jitNetworkAccessPolicyInitiateType
        in: path
        description: Type of the action to do on the Just-in-Time access policy.
        required: true
        x-ms-enum:
          name: JitNetworkAccessPolicyInitiateType
          modelAsString: false
        schema:
          type: string
          enum:
          - initiate
      responses:
        '202':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JitNetworkAccessRequest'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Common.CloudError'
      x-ms-examples:
        Initiate an action on a JIT network access policy:
          $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2020-01-01/examples/JitNetworkAccessPolicies/InitiateJitNetworkAccessPolicy_example.json
      x-source: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/security/resource-manager/Microsoft.Security/Security/stable/2020-01-01/security-SecuritySolutions.json
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/JitNetworkAccessPolicyInitiateRequest'
        required: true
      summary: Jit network access policies initiate
      x-summary-source: derived
components:
  schemas:
    Common.CloudErrorBody:
      type: object
      description: The error detail.
      properties:
        code:
          type: string
          description: The error code.
          readOnly: true
        message:
          type: string
          description: The error message.
          readOnly: true
        target:
          type: string
          description: The error target.
          readOnly: true
        details:
          type: array
          description: The error details.
          items:
            $ref: '#/components/schemas/Common.CloudErrorBody'
          readOnly: true
          x-ms-identifiers: []
        additionalInfo:
          type: array
          description: The error additional info.
          items:
            $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/definitions/ErrorAdditionalInfo
          readOnly: true
          x-ms-identifiers: []
      x-ms-external: true
    JitNetworkAccessRequestVirtualMachine:
      type: object
      properties:
        id:
          type: string
          description: Resource ID of the virtual machine that is linked to this policy
        ports:
          type: array
          description: The ports that were opened for the virtual machine
          items:
            $ref: '#/components/schemas/JitNetworkAccessRequestPort'
      required:
      - id
      - ports
    Status:
      type: string
      description: The status of the port
      enum:
      - Revoked
      - Initiated
      x-ms-enum:
        name: Status
        modelAsString: true
        values:
        - name: Revoked
          value: Revoked
          description: Revoked
        - name: Initiated
          value: Initiated
          description: Initiated
    JitNetworkAccessPolicyInitiateVirtualMachine:
      type: object
      properties:
        id:
          type: string
          description: Resource ID of the virtual machine that is linked to this policy
        ports:
          type: array
          description: The ports to open for the resource with the `id`
          items:
            $ref: '#/components/schemas/JitNetworkAccessPolicyInitiatePort'
      required:
      - id
      - ports
    JitNetworkAccessPolicy:
      type: object
      description: Concrete proxy resource types can be created by aliasing this type using a specific property type.
      properties:
        properties:
          $ref: '#/components/schemas/JitNetworkAccessPolicyProperties'
          x-ms-client-flatten: true
        kind:
          type: string
          description: Kind of the resource
        location:
          type: string
          description: Location where the resource is stored
          readOnly: true
      required:
      - properties
      - location
      allOf:
      - $ref: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/common-types/resource-management/v5/types.json#/definitions/ProxyResource
    Protocol:
      type: string
      enum:
      - TCP
      - UDP
      - '*'
      x-ms-enum:
        name: Protocol
        modelAsString: true
        values:
        - name: TCP
          value: TCP
          description: TCP
        - name: UDP
          value: UDP
          description: UDP
        - name: All
          value: '*'
          description: '*'
    StatusReason:
      type: string
      description: A description of why the `status` has its value
      enum:
      - Expired
      - UserRequested
      - NewerRequestInitiated
      x-ms-enum:
        name: StatusReason
        modelAsString: true
        values:
        - name: Expired
          value: Expired
          description: Expired
        - name: UserRequested
          value: UserRequested
          description: UserRequested
        - name: NewerRequestInitiated
          value: NewerRequestInitiated
          description: NewerRequestInitiated
    JitNetworkAccessPortRule:
      type: object
      properties:
        number:
          type: integer
          format: int32
          minimum: 0
          maximum: 65535
        protocol:
          $ref: '#/components/schemas/Protocol'
        allowedSourceAddressPrefix:
          type: string
          description: Mutually exclusive with the "allowedSourceAddressPrefixes" parameter. Should be an IP address or CIDR, for example "192.168.0.3" or "192.168.0.0/16".
        allowedSourceAddressPrefixes:
          type: array
          description: Mutually exclusive with the "allowedSourceAddressPrefix" parameter.
          items:
            type: string
        maxRequestAccessDuration:
          type: string
          description: Maximum duration requests can be made for. In ISO 8601 duration format. Minimum 5 minutes, maximum 1 day
      required:
      - number
      - protocol
      - maxRequestAccessDuration
    JitNetworkAccessPolicyInitiatePort:
      type: object
      properties:
        number:
          type: integer
          format: int32
          minimum: 0
          maximum: 65535
        allowedSourceAddressPrefix:
          type: string
          description: Source of the allowed traffic. If omitted, the request will be for the source IP address of the initiate request.
        endTimeUtc:
          type: string
          format: date-time
          description: The time to close the request in UTC
      required:
      - number
      - endTimeUtc
    JitNetworkAccessRequestPort:
      type: object
      properties:
        number:
          type: integer
          format: int32
          minimum: 0
          maximum: 65535
        allowedSourceAddressPrefix:
          type: string
          description: Mutually exclusive with the "allowedSourceAddressPrefixes" parameter. Should be an IP address or CIDR, for example "192.168.0.3" or "192.168.0.0/16".
        allowedSourceAddressPrefixes:
          type: array
          description: Mutually exclusive with the "allowedSourceAddressPrefix" parameter.
          items:
            type: string
        endTimeUtc:
          type: string
          format: date-time
          description: The date & time at which the request ends in UTC
        status:
          $ref: '#/components/schemas/Status'
          description: The status of the port
        statusReason:
          $ref: '#/components/schemas/StatusReason'
          description: A description of why the `status` has its value
        mappedPort:
          type: integer
          format: int32
          description: The port which is mapped to this port's `number` in the Azure Firewall, if applicable
      required:
      - number
      - endTimeUtc
      - status
      - statusReason
    JitNetworkAccessPolicyVirtualMachine:
      type: object
      properties:
        id:
          type: string
          description: Resource ID of the virtual machine that is linked to this policy
        ports:
          type: array
          description: Port configurations for the virtual machine
          items:
            $ref: '#/components/schemas/JitNetworkAccessPortRule'
        publicIpAddress:
          type: string
          description: Public IP address of the Azure Firewall that is linked to this policy, if applicable
      required:
      - id
      - ports
    JitNetworkAccessPoliciesList:
      type: object
      properties:
        value:
          type: array
          items:
            $ref: '#/components/schemas/JitNetworkAccessPolicy'
        nextLink:
          type: string
          readOnly: true
    JitNetworkAccessRequest:
      type: object
      properties:
        virtualMachines:
          type: array
          items:
            $ref: '#/components/schemas/JitNetworkAccessRequestVirtualMachine'
        startTimeUtc:
          type: string
          format: date-time
          description: The start time of the request in UTC
        requestor:
          type: string
          description: The identity of the person who made the request
        justification:
          type: string
          description: The justification for making the initiate request
      required:
      - virtualMachines
      - startTimeUtc
      - requestor
    JitNetworkAccessPolicyProperties:
      type: object
      properties:
        virtualMachines:
          type: array
          description: Configurations for Microsoft.Compute/virtualMachines resource type.
          items:
            $ref: '#/components/schemas/JitNetworkAccessPolicyVirtualMachine'
        requests:
          type: array
          items:
            $ref: '#/components/schemas/JitNetworkAccessRequest'
        provisioningState:
          type: string
          description: Gets the provisioning state of the Just-in-Time policy.
          readOnly: true
      required:
      - virtualMachines
    JitNetworkAccessPolicyInitiateRequest:
      type: object
      properties:
        virtualMachines:
          type: array
          description: A list of virtual machines & ports to open access for
          items:
            $ref: '#/components/schemas/JitNetworkAccessPolicyInitiateVirtualMachine'
        justification:
          type: string
          description: The justification for making the initiate request
      required:
      - virtualMachines
    Common.CloudError:
      type: object
      description: Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.).
      properties:
        error:
          $ref: '#/components/schemas/Common.CloudErrorBody'
          description: The error object.
          x-ms-client-flatten: true
      x-ms-external: true
  securitySchemes:
    azure_auth:
      type: oauth2
      flows:
        implicit:
          scopes:
            user_impersonation: impersonate your user account
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
      description: Azure Active Directory OAuth2 Flow.