Just-in-time VM access is enabled for all virtual machines. To connect to a VM by using Remote Desktop, what should you do first?

When Just-in-Time (JIT) VM access is enabled, direct RDP/SSH connections are blocked by a network security group (NSG). To gain temporary access, you must request it through the Azure portal. Selecting the VM, then "Connect," and finally "Request access" initiates the JIT process, which opens the necessary ports for a limited time. Activating roles in Azure AD PIM, such as Security administrator or Owner, grants elevated permissions within Azure AD or for the resource, respectively, but it does not directly bypass the JIT access policy for a VM. JIT is a separate security control that manages network access. Adding the Network Watcher Agent extension is for network diagnostics and monitoring, not for enabling RDP/SSH access.