Azure Bastion

What is Azure Bastion?

Azure Bastion is a fully managed PaaS service that provides secure, seamless RDP and SSH connectivity to your VMs directly from the Azure Portal — over TLS (HTTPS, port 443). Your VMs don't need public IP addresses, and you don't need to open SSH (22) or RDP (3389) ports to the internet.

How Bastion Works

Here's the connection flow when you use Azure Bastion:

1. You open the Azure Portal in your browser (HTTPS, port 443)
2. You navigate to your VM and click Connect → Bastion
3. Your browser connects to the Bastion host — which lives inside your VNet in a dedicated subnet called AzureBastionSubnet
4. Bastion connects to your VM using its private IP address over the VNet — SSH port 22 or RDP port 3389, but only on the internal network
5. The terminal or desktop session streams back to your browser over the already-open HTTPS connection

Bastion SKUs

Azure Bastion comes in three tiers:

Deploying Azure Bastion

Requirements

• A Virtual Network with an AzureBastionSubnet subnet (minimum /26 size)
• A Standard SKU Public IP address assigned to Bastion
• The subnet must be named exactly AzureBastionSubnet — no other name is accepted

Via Azure Portal

1. Search for Bastions in the portal
2. Click + Create
3. Select your subscription, resource group, and region
4. Give it a name (e.g., bastion-prod)
5. Select your VNet — Azure will create the AzureBastionSubnet automatically if it doesn't exist
6. Create or select a Public IP for Bastion
7. Select the SKU (Basic for getting started)
8. Click Review + Create → Create

Deployment takes about 5–10 minutes.

Via Azure CLI

# Create the AzureBastionSubnet in your VNet
az network vnet subnet create \
  --resource-group myResourceGroup \
  --vnet-name myVNet \
  --name AzureBastionSubnet \
  --address-prefixes 10.0.1.0/26

# Create a public IP for Bastion
az network public-ip create \
  --resource-group myResourceGroup \
  --name bastion-pip \
  --sku Standard \
  --location centralindia

# Create the Bastion host
az network bastion create \
  --resource-group myResourceGroup \
  --name bastion-prod \
  --public-ip-address bastion-pip \
  --vnet-name myVNet \
  --location centralindia \
  --sku Basic

Connecting to VMs via Bastion

Once Bastion is deployed:

1. Go to your VM in the Azure Portal
2. Click Connect in the top menu
3. Select Bastion
4. Enter your credentials (username + password, or username + SSH key)
5. Click Connect
6. A new browser tab opens with your SSH terminal or RDP desktop

Native Client Support (Standard SKU)

The Standard SKU also supports connecting via your local SSH or RDP client (not just the browser). This is useful if you prefer a full-featured client with copy-paste, multiple tabs, etc.

az network bastion ssh \
  --name bastion-prod \
  --resource-group myResourceGroup \
  --target-resource-id /subscriptions/.../virtualMachines/myVM \
  --auth-type ssh-key \
  --username azureuser \
  --ssh-key ~/.ssh/id_rsa

Bastion vs Direct SSH/RDP

Cost Considerations

Azure Bastion is charged per deployment hour plus per outbound data. Key points:

• You pay for Bastion even when no one is connected — it's always-on infrastructure
• One Bastion host covers all VMs in the same VNet (and peered VNets)
• For a large team accessing many VMs, one Bastion host is far cheaper than giving each VM a public IP
• For a single dev VM you use occasionally, direct SSH with an IP-restricted NSG may be more cost-effective

Best Practices

• Use Bastion for all production VMs — Never expose port 22 or 3389 on production systems
• One Bastion per VNet — A single Bastion host covers all VMs in the VNet
• Remove public IPs from VMs behind Bastion — If you're using Bastion, VMs don't need public IPs at all
• Use Standard SKU for teams — File transfer and native client support are essential for real teams
• Developer SKU for learning — Free, no infrastructure setup required