Lab: Private DNS and Bastion administration

Outcome

Link a private DNS zone to a VNet and prove internal resolution, then connect to a private-only VM through Bastion without giving the VM a public IP.

Do

1. Create a VNet with workload and correctly named AzureBastionSubnet subnets. Deploy a small VM with only a private IP. Create a private DNS zone such as training.internal, add an A record for the VM, and link the workload VNet without autoregistration.
2. From a test VM in the linked VNet, resolve the record and connect to the private IP/service. Record the zone, link status, record, resolver settings, and result. A linked VNet without autoregistration resolves records but does not automatically register VM records.
3. Deploy Bastion in AzureBastionSubnet; use the portal browser SSH/RDP path to the target VM. Verify that the target VM has no public IP and record the reader/connect permissions required for the user.

Verify

Capture the zone/link/record, successful linked-VNet lookup, Bastion resource, private-only target NIC, and browser connection. You should now understand: a private zone needs a VNet link for Azure-provided DNS resolution; Bastion reaches the target VM over its private IP, not a VM public IP.

Break and fix

1. Remove the VNet link or use a custom DNS server that lacks a conditional forwarder. Record failed lookup, restore the link/default resolver or correct the forwarder, and retest.
2. Attempt Bastion deployment with an incorrectly named or too-small dedicated subnet. Correct the dedicated subnet configuration; do not place a workload in it.
3. Try a browser connection with a test user missing one required Reader scope. Diagnose the missing resource/NIC/VNet/Bastion visibility or guest login right, assign only the required training permission, and retry.

Scenario practice

1. Configure: Select a resolution-only versus autoregistration VNet link for an application zone.
2. Diagnose: A VM resolves public names but not app.training.internal. Inspect link status, VNet DNS setting, record, and custom-DNS forwarding.
3. Distinguish: Contrast a private DNS zone with public DNS, and Bastion with assigning a VM public IP for SSH/RDP.

Clean up

Disconnect, remove test roles, delete Bastion, the VM, zone link/record/zone, VNet, and the disposable resource group.

Sources and re-audit

• Private DNS virtual network links, checked 2026-08-22.
• Private DNS zone overview, checked 2026-08-22.
• Azure Bastion FAQ, checked 2026-08-22.

Re-audit when DNS resolution order, link behavior, or Bastion requirements change.

Related

private-dns · azure-bastion · vnet · rbac · All labs