JEA Endpoint Behavior Changes When Switching PowerShell Remoting to SSH Transport

Organizations evaluating the shift from WinRM to SSH as the transport for PowerShell remoting need to know whether existing Just Enough Administration (JEA) endpoints continue to enforce their role definitions and session restrictions without modification. While SSH provides a cross‑platform, firewall‑friendly channel, it does not expose the full WS‑Management feature set that WinRM‑based remoting relies on for certain JEA behaviors such as constrained language mode enforcement and detailed audit logging.

Because the SSH subsystem invokes the PowerShell executable directly, some WinRM‑specific processing—like the automatic application of ConnectionInfo options and the propagation of certain WS‑Man headers—is absent. This raises uncertainty about whether JEA’s role capability files, session configurations, and logging mechanisms will behave identically when the underlying transport changes.

Does SSH transport preserve JEA role capabilities and session constraints? What configuration adjustments, if any, are required for JEA endpoints to operate over SSH? Are there any limitations in logging or auditing when JEA uses SSH transport?