A virtual network contains several subnets and your subscription contains multiple virtual machines (details in the tables). You enabled Just-In-Time (JIT) VM access for all virtual machines. Based on the provided subnet and VM configuration, which virtual machines are protected by JIT?

JIT VM access protects Azure VMs, not on-premises VMs. VM1, VM3, and VM4 are Azure virtual machines, making them eligible for JIT protection. VM2 is an on-premises virtual machine, as indicated by its location, and therefore cannot be protected by Azure Security Center's JIT VM access feature. JIT is an Azure Security Center feature that reduces the attack surface by locking down inbound traffic to your Azure VMs, opening specified ports only when needed and for a limited time.