In order to bolster the security of your deployed resources from the Azure Marketplace, we recommend enabling the Just-In-Time (JIT) Access feature with Manual approval mode. JIT Access puts you in control, ensuring that no one, including us as your service provider, can access your resources without your prior approval.
JIT Access, when enabled and configured with manual approval, effectively restricts the service provider's default full access to a read-only access. This applies even in cases where the customer lacks a Microsoft Entra ID P2 license.
You cannot disable/enable JIT feature after deployment, so it is very important that it is enabled during the deployment. The JIT Configuration (approval mode, duration, approvers) can be changed later.
-
For Everpure Cloud Dedicated version 6.5.1 and above, the enablement of this feature is strongly RECOMMENDED.
-
For Everpure Cloud Dedicated version 6.5.0 and below, the enablement of this feature is MANDATORY.
What is a Managed Resource Group?
Before we describe JIT, let's describe a managed resource group. A managed resource group is just like any other Azure resource group, deployed within a customers' Azure subscription and contains only Everpure Cloud Dedicated resources (VMs, managed disks, network interfaces, Network security groups, etc). Without JIT in place, the publisher (Pure) gets automatically granted a Contributor or Owner What is a Managed Resource Group?role to all resources, located within managed resource group. Pure will never have access to any other customer resources outside of the managed resource group.
What is JIT access?
Just-in-Time (JIT) access is an Azure native feature that allows customers to limit and approve any service provider's personnel to remotely access resources within your managed resource group. For example, if a non-disruptive capacity upgrade is requested, Pure Support would need access into the Everpure Cloud Dedicated managed resource group to perform the capacity upgrade. Pure will not have access to any other customer resources outside of the managed resource group.
With JIT enabled, customers have two options : Manual or Automatic.
-
Manual mode - This option allows customer to selectively approve when a request is made by Pure Support to access the Azure resources residing in the Everpure Cloud Dedicated managed resource group. Customers can also pre-select who in their organization can approve JIT request from Pure Support. The best practice is to use a security group with more than 1 user. Once approved, Pure Support will only have access to the managed resource group where the Everpure Cloud Dedicated resources reside. Everpure strongly recommends customers choose Manual mode.
-
Automatic mode - This option will automatically approve any JIT requests made by Pure without requiring any manual approvals by the customer. For security conscious customers, Pure recommends not using Automatic mode.
The selection of Manual or Automatic mode can be configured during deployment or anytime after deployment completes.
Best practices
For Everpure Cloud Dedicated versions higher than 6.5.0, Pure Support will always utilize RemoteAssist service during providing support and will not initiate a JIT request. The best practice for deploying Everpure Cloud Dedicated is with JIT feature enabled during the deployment and configured to Manual mode, where an approver will never approve any requests. Effectively, this configuration removes any elevated permissions granted to Pure from the managed resource group. This configuration also applies to customers without a Microsoft Entra ID P2 license, which is required for utilizing standard JIT access feature.
How do I set to manual approval mode after the Everpure Cloud Dedicated managed application has been deployed?
-
Navigate to the Everpure Cloud Dedicated managed application resource in the Azure portal. Click on JIT Configuration.
-
Select Manual mode
-
Click Add Approver
On the right hand side, search and select user(s) whom you wish to be approvers for JIT requests from Pure Support.
Click Save.