Azure Bastion

What it is

Azure Bastion is a managed service for connecting to virtual machines with RDP or SSH over TLS. An administrator can connect in the Azure portal, and selected SKUs also support a native SSH or RDP client. The target VM uses its private IP address and does not need a public IP, agent, or special client software.

Why it exists

Opening RDP (3389) or SSH (22) directly to the internet expands a VM’s attack surface. Bastion provides a managed entry point so the VM can remain private while administrators still have an interactive management path.

Key ideas

• Basic, Standard, and Premium are dedicated deployments in a virtual network and require a dedicated subnet named AzureBastionSubnet. Do not place workload VMs in that subnet.
• Premium supports a private-only deployment without a public IP. Dedicated Basic and Standard deployments normally require a public IP. Developer is a shared-infrastructure SKU for development and test with different requirements and limitations.
• Standard and Premium add capabilities such as native-client connections; Premium adds session recording and private-only deployment. Select the SKU from the connection, compliance, resilience, and cost requirement.
• Bastion is for interactive VM administration. It is not a load balancer, VPN gateway, private endpoint, or a substitute for general private network access.
• Network rules control the path to the VM, and guest OS identity controls sign-in. Bastion does not make an unauthorized Azure user an authorized Windows or Linux user.

Northwind example

Maya needs to troubleshoot a private Northwind VM after a failed deployment. She uses Bastion to start an RDP or SSH session without assigning the VM a public IP or opening RDP/SSH to the internet. The VM’s network security group permits the intended Bastion path, and Maya still signs in with a guest OS account she is authorized to use. For staff who need access to many private services, Northwind chooses a VPN or ExpressRoute design instead of treating Bastion as a general employee network.

When to choose it

Requirement	Start by considering
Interactive RDP or SSH to private Azure VMs	Azure Bastion
General private access from users or an on-premises network	VPN Gateway or ExpressRoute
Private access to a PaaS service such as Storage	[[private-endpoint

Common confusion

• Bastion protects the VM from direct public RDP/SSH exposure; it does not remove the need to patch, secure, monitor, and back up the VM.
• A public IP on a dedicated Bastion resource is not the same as a public IP on every target VM.
• Bastion starts a session; it does not manage VM permissions, application credentials, or business-data authorization.

Related

vnet · subnet · nsg · public-ip-address

Sources and re-audit

• Microsoft Learn — What is Azure Bastion?, checked 2026-09-16.