{"id":488,"date":"2026-04-14T05:47:52","date_gmt":"2026-04-14T05:47:52","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/azure-bastion-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-networking\/"},"modified":"2026-04-14T05:47:52","modified_gmt":"2026-04-14T05:47:52","slug":"azure-bastion-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-networking","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/azure-bastion-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-networking\/","title":{"rendered":"Azure Bastion Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Networking"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Networking<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p>Azure Bastion is a managed Azure Networking service that lets you securely connect to Azure virtual machines (VMs) using RDP (Windows) or SSH (Linux) without giving those VMs public IP addresses and without opening inbound ports (like 3389\/22) to the internet.<\/p>\n\n\n\n<p>In simple terms: Azure Bastion is a secure \u201cjump box as a service.\u201d You connect to it from the Azure portal (and, with supported options, from native clients), and it proxies your RDP\/SSH session to a VM over a private IP inside your virtual network (VNet).<\/p>\n\n\n\n<p>Technically, you deploy an Azure Bastion resource into a dedicated subnet named <code>AzureBastionSubnet<\/code> in your VNet. Azure manages the underlying hosts and patching. Users authenticate to Azure, and their sessions are brokered through Bastion over HTTPS (port 443) to the Bastion service, which then connects privately to target VMs in the VNet (and, depending on SKU\/features, potentially peered VNets). This reduces your public attack surface and simplifies secure administrative access.<\/p>\n\n\n\n<p>Azure Bastion solves a common problem in cloud networking and security: administrators need reliable interactive access to VMs for troubleshooting and operations, but exposing management ports to the internet (even with IP allowlists) increases risk and operational burden. Bastion provides controlled access while keeping VMs private.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is Azure Bastion?<\/h2>\n\n\n\n<p><strong>Official purpose (in Azure terms):<\/strong> Azure Bastion provides secure and seamless RDP and SSH connectivity to your virtual machines directly from the Azure portal (and supported client options), over TLS, without exposing public IP addresses on the VMs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Core capabilities<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>RDP\/SSH to private VMs<\/strong> without public IPs<\/li>\n<li><strong>TLS\/HTTPS-based access<\/strong> (commonly via Azure portal over 443)<\/li>\n<li><strong>Managed bastion hosts<\/strong> maintained by Azure (no IaaS jump server to patch\/harden)<\/li>\n<li><strong>Per-VNet deployment model<\/strong> (a Bastion resource is deployed into a specific VNet)<\/li>\n<li><strong>Integration with Azure IAM (RBAC)<\/strong> and Azure monitoring\/diagnostics<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Major components<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Azure Bastion resource<\/strong>: The managed service instance you create in Azure.<\/li>\n<li><strong><code>AzureBastionSubnet<\/code><\/strong>: A dedicated subnet in your VNet reserved for Bastion. Azure requires this exact subnet name.<\/li>\n<li><strong>Public IP address for Bastion<\/strong>: Used as the entry point for the Bastion service (VMs do not need public IPs).<\/li>\n<li><strong>Target VMs<\/strong>: Windows or Linux VMs reachable via private IP within the VNet.<\/li>\n<li><strong>Azure control plane<\/strong>: Deployment and access control via Azure Resource Manager (ARM), RBAC, and policy.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Service type<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>PaaS-managed networking service<\/strong> (you manage configuration; Azure manages underlying hosts, scaling constructs, and updates within the service boundary).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scope and locality<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Regional<\/strong>: Azure Bastion is deployed into a VNet in a specific Azure region (VNets are regional resources). High availability characteristics and zonal capabilities may depend on region and SKU\u2014<strong>verify current options in official docs<\/strong>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How it fits into the Azure ecosystem<\/h3>\n\n\n\n<p>Azure Bastion is commonly used alongside:\n&#8211; <strong>Azure Virtual Network (VNet)<\/strong>: the network boundary where Bastion lives.\n&#8211; <strong>Network Security Groups (NSGs)<\/strong>: to tightly control traffic to VM subnets (and to follow Bastion subnet rule requirements if you associate NSGs).\n&#8211; <strong>Azure Firewall<\/strong> \/ <strong>Network Virtual Appliances (NVAs)<\/strong>: for centralized egress control and segmentation.\n&#8211; <strong>Private endpoints \/ Private Link<\/strong>: to keep PaaS access private, complementing Bastion for VM access.\n&#8211; <strong>Azure Monitor \/ Log Analytics<\/strong>: for diagnostics and operational visibility.\n&#8211; <strong>Azure Policy<\/strong>: to enforce \u201cno public IP on VM NICs\u201d or other security standards.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use Azure Bastion?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Reduce breach risk<\/strong> by eliminating public exposure of VM management ports.<\/li>\n<li><strong>Lower operational overhead<\/strong> compared to running and maintaining jump box VMs.<\/li>\n<li><strong>Improve audit posture<\/strong> by centralizing how administrators reach VMs (with Azure-native logging\/controls).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>No public IP required on VMs<\/strong>, helping keep workloads private by default.<\/li>\n<li><strong>No inbound NSG rules from internet<\/strong> to VM subnets for RDP\/SSH.<\/li>\n<li><strong>Simplified access patterns<\/strong> for admins and operators (browser-based access is a common baseline).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Fewer moving parts<\/strong> than self-managed bastion\/jump hosts (no OS patching, antivirus, disk management, or VM resizing for the bastion itself).<\/li>\n<li><strong>Consistent access method<\/strong> across many VMs within the VNet (and potentially across peered VNets depending on SKU\/feature support\u2014verify in docs).<\/li>\n<li><strong>Works well for break-glass access<\/strong> when VPNs\/ExpressRoute are unavailable (subject to your org\u2019s security rules).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Shrinks attack surface<\/strong>: you can enforce \u201cno public IP on VM NIC\u201d policies and rely on Bastion for interactive access.<\/li>\n<li><strong>Integrates with Azure RBAC<\/strong> so only authorized users can initiate connections.<\/li>\n<li><strong>Supports segmentation<\/strong>: VM subnets can be locked down to accept RDP\/SSH only from the Bastion subnet.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Service-managed scaling<\/strong> within the Bastion model (exact scaling behavior depends on SKU\u2014verify in official docs).<\/li>\n<li><strong>Avoids bottlenecks<\/strong> of a single small jump VM (though Bastion itself has service limits and concurrent session considerations).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose Azure Bastion<\/h3>\n\n\n\n<p>Choose Azure Bastion when you want:\n&#8211; Private VMs without public IPs\n&#8211; Centralized, controlled RDP\/SSH access\n&#8211; Reduced operational burden compared to jump box VMs\n&#8211; Fast setup for secure admin access in dev\/test and production\n&#8211; A standardized approach that security teams can approve<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should not choose it<\/h3>\n\n\n\n<p>Consider alternatives when:\n&#8211; You need <strong>full network-level access<\/strong> from admin devices to private subnets (use <strong>VPN Gateway<\/strong> or <strong>ExpressRoute<\/strong>).\n&#8211; You require <strong>session recording<\/strong> as a built-in feature (Bastion is not primarily a session recording product; use OS-level logging, SIEM tooling, or specialized PAM tools\u2014verify current feature set).\n&#8211; Your environment requires <strong>strict private-only ingress<\/strong> with no public endpoint at all (evaluate designs using private connectivity, or confirm whether your requirements can be met with Bastion plus compensating controls; verify options in docs).\n&#8211; You already have mature <strong>PAM \/ zero-trust access tooling<\/strong> that meets requirements and is standardized across clouds.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is Azure Bastion used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Financial services, healthcare, and government: reduce exposed attack surface and support compliance controls.<\/li>\n<li>SaaS and tech companies: secure operations access without maintaining jump servers.<\/li>\n<li>Manufacturing\/retail: standardize access for distributed ops teams.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud platform teams standardizing landing zones<\/li>\n<li>Security engineering teams enforcing \u201cno public IPs\u201d<\/li>\n<li>SRE\/operations teams needing emergency access paths<\/li>\n<li>DevOps teams managing ephemeral environments<\/li>\n<li>Developers accessing test VMs safely<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Line-of-business apps hosted on IaaS VMs<\/li>\n<li>Legacy apps requiring VM admin access<\/li>\n<li>Kubernetes worker nodes or supporting VMs (when direct node access is necessary and allowed)<\/li>\n<li>Data processing VMs, build agents, and batch compute nodes<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Hub-and-spoke networks where Bastion sits in a spoke VNet or hub VNet depending on access model<\/li>\n<li>Segmented VNets with locked-down subnets<\/li>\n<li>Environments where inbound internet is tightly controlled or eliminated for workloads<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Real-world deployment contexts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Production<\/strong>: Bastion as the standard path for RDP\/SSH to private VMs, combined with strict RBAC and logging.<\/li>\n<li><strong>Dev\/test<\/strong>: Quick access to sandbox VMs without needing a VPN client rollout.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are practical scenarios where Azure Bastion is commonly used. Each example includes the problem, why Bastion fits, and a short scenario.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Remove public IPs from admin-access VMs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> VMs have public IPs solely for RDP\/SSH, increasing risk and scanning noise.<\/li>\n<li><strong>Why Azure Bastion fits:<\/strong> Provides RDP\/SSH without public IPs or inbound internet rules to VM subnets.<\/li>\n<li><strong>Example:<\/strong> A team removes public IPs from 200 Windows servers and mandates Bastion for all interactive access.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Secure break-glass access for incident response<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> During incidents, VPN\/ExpressRoute may be impaired or admins may be off-network.<\/li>\n<li><strong>Why Azure Bastion fits:<\/strong> Portal-based access over HTTPS (443) is often easier to allow through enterprise egress controls.<\/li>\n<li><strong>Example:<\/strong> An on-call engineer uses Bastion to access a private VM to restart services when the VPN concentrator is down.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Standardize VM access across teams<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Different teams run different jump hosts, credentials, and firewall rules.<\/li>\n<li><strong>Why Azure Bastion fits:<\/strong> Centralizes the VM access pattern at the VNet level and aligns with Azure RBAC.<\/li>\n<li><strong>Example:<\/strong> A platform team publishes a standard \u201cVM access\u201d pattern: private VM + Bastion + RBAC + logging.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Restrict RDP\/SSH to a single trusted source in the VNet<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Even inside the VNet, lateral movement risks increase if many subnets can reach management ports.<\/li>\n<li><strong>Why Azure Bastion fits:<\/strong> You can lock down VM subnet NSGs to only allow RDP\/SSH from the Bastion subnet.<\/li>\n<li><strong>Example:<\/strong> NSGs allow TCP\/22 and TCP\/3389 only from <code>AzureBastionSubnet<\/code> CIDR; all other sources denied.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Contractor\/admin access without extending corporate network<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Providing VPN access to contractors is high-risk and high-effort.<\/li>\n<li><strong>Why Azure Bastion fits:<\/strong> Lets authorized users connect through Azure\u2019s access controls without full network extension.<\/li>\n<li><strong>Example:<\/strong> A vendor is granted time-bound access via Azure RBAC to connect to a specific VM through Bastion.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Access to VMs in locked-down subnets (no inbound from internet)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Strict environments forbid inbound internet to workload subnets.<\/li>\n<li><strong>Why Azure Bastion fits:<\/strong> Bastion is the only ingress path for interactive admin protocols, while workloads remain private.<\/li>\n<li><strong>Example:<\/strong> A PCI environment uses Bastion for Windows patch verification without opening 3389 inbound.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Day-2 operations for legacy apps hosted on VMs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Legacy apps require frequent interactive troubleshooting, config edits, and patching windows.<\/li>\n<li><strong>Why Azure Bastion fits:<\/strong> Provides convenient RDP\/SSH access while maintaining private networking.<\/li>\n<li><strong>Example:<\/strong> Ops team uses Bastion weekly during maintenance without exposing the VM to the internet.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Reduce jump server sprawl and patching burden<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Self-managed jump servers must be patched, monitored, and scaled.<\/li>\n<li><strong>Why Azure Bastion fits:<\/strong> Managed service reduces operational overhead and standardizes access.<\/li>\n<li><strong>Example:<\/strong> An org retires dozens of jump VMs and replaces them with Bastion in each environment VNet.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Support controlled access in hub-and-spoke topologies<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Spoke VNets contain workloads; administrators need access without broad network exposure.<\/li>\n<li><strong>Why Azure Bastion fits:<\/strong> Deploy Bastion strategically (hub or spoke) and route access privately (capabilities vary\u2014verify peering support by SKU).<\/li>\n<li><strong>Example:<\/strong> Bastion deployed in a management VNet; admins connect to VM subnets via private peering.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Enable \u201cprivate by default\u201d landing zones<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Developers default to public IPs for convenience, creating governance drift.<\/li>\n<li><strong>Why Azure Bastion fits:<\/strong> Paired with policy (\u201cdeny public IP on NIC\u201d), Bastion becomes the approved access method.<\/li>\n<li><strong>Example:<\/strong> A landing zone blueprint includes Bastion and policies; dev teams can still SSH\/RDP without public IPs.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<p>Azure Bastion\u2019s features vary by SKU and region. Always confirm the latest matrix in official docs before standardizing. The items below reflect commonly documented capabilities; where SKU specifics matter, it\u2019s called out.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Browser-based RDP\/SSH over TLS (portal experience)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Lets users initiate RDP or SSH sessions from the Azure portal to a VM\u2019s private IP.<\/li>\n<li><strong>Why it matters:<\/strong> Users don\u2019t need direct network reachability to the VNet; the portal connection is typically over HTTPS (443).<\/li>\n<li><strong>Practical benefit:<\/strong> Quick access from managed desktops without installing RDP\/SSH clients (for portal-based connection).<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Browser experience depends on portal availability and user environment restrictions (pop-up blockers, corporate proxies). Verify supported browsers and constraints in docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">No public IP required on target VMs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Eliminates the need for public IPs on VMs used for admin access.<\/li>\n<li><strong>Why it matters:<\/strong> Reduces attack surface and aligns with \u201cprivate workloads\u201d governance.<\/li>\n<li><strong>Practical benefit:<\/strong> Easier compliance story; less exposure to scanning and brute-force attempts.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> You still need a network path from Bastion to the VM (routing, NSGs, and VM firewall rules must allow it).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Dedicated <code>AzureBastionSubnet<\/code> requirement<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Forces Bastion to run in a dedicated subnet with a specific name.<\/li>\n<li><strong>Why it matters:<\/strong> Separates Bastion infrastructure from workloads and supports service-managed behavior.<\/li>\n<li><strong>Practical benefit:<\/strong> Clear segmentation boundary; easier to apply subnet-specific controls.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Subnet sizing is strict (commonly <code>\/26<\/code> minimum). If you misname the subnet or size it too small, deployment fails.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Azure RBAC-controlled access<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Uses Azure identity and role assignments to control who can initiate Bastion connections and who can access the target VM resource.<\/li>\n<li><strong>Why it matters:<\/strong> Centralizes authorization and supports least privilege and JIT-style governance patterns (often combined with privileged identity processes).<\/li>\n<li><strong>Practical benefit:<\/strong> Avoids shared jump host credentials; aligns with enterprise access reviews.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Required permissions involve both the Bastion resource and the target VM. Exact required actions\/roles can change\u2014verify current RBAC requirements in official docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">SKU-based feature set (e.g., Basic vs Standard)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Azure Bastion is offered in multiple SKUs with different capabilities (for example, Standard commonly includes more features than Basic).<\/li>\n<li><strong>Why it matters:<\/strong> Your choice impacts cost, scalability, and supported scenarios (such as certain advanced connectivity options).<\/li>\n<li><strong>Practical benefit:<\/strong> You can start small in dev\/test and choose richer capabilities for production.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Feature availability differs by SKU and region; confirm the latest comparison in docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Native client support \/ tunneling (SKU-dependent)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Allows using native SSH\/RDP clients through Bastion by creating a tunnel (often driven via Azure CLI tooling).<\/li>\n<li><strong>Why it matters:<\/strong> Some workflows require native client features (SSH agent forwarding, certain RDP client capabilities, automation).<\/li>\n<li><strong>Practical benefit:<\/strong> Integrates with existing admin tooling and scripts.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> This is commonly SKU-dependent and may require Azure CLI extension support; verify supported OS\/client requirements in docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">File transfer (SKU-dependent)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Enables transferring files during Bastion sessions (commonly available in Standard SKU; verify current status).<\/li>\n<li><strong>Why it matters:<\/strong> Securely move logs, scripts, or patches without opening new inbound paths.<\/li>\n<li><strong>Practical benefit:<\/strong> Operational convenience for troubleshooting.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Govern carefully\u2014file transfer can become a data exfil path. Use RBAC, auditing, and endpoint controls.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Session management and concurrent connections (service limits)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Supports multiple user sessions; limits depend on SKU and service design.<\/li>\n<li><strong>Why it matters:<\/strong> Production ops teams may have many parallel sessions during incidents.<\/li>\n<li><strong>Practical benefit:<\/strong> Avoids \u201csingle jump box\u201d bottleneck.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Concurrency and scale characteristics are governed by SKU and service limits; verify official limits and plan accordingly.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Diagnostics and logging integration<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Emits logs\/metrics via Azure Monitor diagnostic settings (where supported), enabling routing to Log Analytics, Event Hubs, or Storage.<\/li>\n<li><strong>Why it matters:<\/strong> Access paths are security-sensitive and should be auditable.<\/li>\n<li><strong>Practical benefit:<\/strong> Centralized observability and SIEM integration.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Confirm which log categories are available and what they contain in official docs.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level architecture<\/h3>\n\n\n\n<p>Azure Bastion is deployed into a VNet and acts as a managed access proxy for RDP\/SSH. Users authenticate to Azure and then initiate sessions via the Azure portal (or supported native client methods). Bastion connects to VMs using private IPs within the VNet.<\/p>\n\n\n\n<p>Key points:\n&#8211; Bastion is <strong>inside<\/strong> your VNet but is <strong>managed<\/strong> by Azure.\n&#8211; Target VMs remain private (no public IP required).\n&#8211; The client-to-Bastion path is typically <strong>HTTPS (443)<\/strong>.\n&#8211; The Bastion-to-VM path is <strong>RDP\/SSH<\/strong> over private networking.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Request\/data\/control flow (conceptual)<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>User<\/strong> signs into Azure and opens the Azure portal (or uses supported CLI-based connection).<\/li>\n<li>The user selects a <strong>VM<\/strong> and chooses <strong>Connect via Bastion<\/strong>.<\/li>\n<li>The browser establishes an <strong>encrypted session<\/strong> to the Bastion endpoint.<\/li>\n<li>Bastion initiates a private <strong>RDP\/SSH connection<\/strong> to the VM\u2019s private IP.<\/li>\n<li>The interactive session is proxied through Bastion; the VM never needs inbound internet exposure.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related services<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Azure Virtual Network<\/strong>: Bastion must be in the same VNet as targets (and\/or connected VNets depending on supported peering features and SKU\u2014verify).<\/li>\n<li><strong>NSGs<\/strong>: Used to restrict VM subnets and optionally applied to Bastion subnet with required rules.<\/li>\n<li><strong>Azure Firewall \/ NVAs<\/strong>: Often used for egress control from workloads; Bastion is separate but must be considered in routing design.<\/li>\n<li><strong>Azure Monitor<\/strong>: Diagnostic settings for logs\/metrics.<\/li>\n<li><strong>Azure Policy<\/strong>: Enforce \u201cno public IP,\u201d required tags, or approved SKUs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Public IP (for Bastion endpoint)<\/li>\n<li>VNet + dedicated Bastion subnet<\/li>\n<li>Target VM reachable via private IP and allowed ports (22\/3389 or custom ports depending on features)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Authentication to Azure<\/strong>: Users authenticate via Entra ID (Azure AD) to the portal\/CLI.<\/li>\n<li><strong>Authorization<\/strong>: Azure RBAC governs ability to use Bastion and access VM resources.<\/li>\n<li><strong>VM credentials<\/strong>: For OS-level login, you still need valid VM credentials (SSH key\/user or Windows credentials), unless using supported identity-based login methods on the VM OS (verify supported identity methods and prerequisites).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Bastion resides in <code>AzureBastionSubnet<\/code>.<\/li>\n<li>VMs are in workload subnets.<\/li>\n<li>Traffic from Bastion to VMs uses private IP routing.<\/li>\n<li>You can lock down VM NSGs to only permit management traffic from the Bastion subnet range.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable Bastion diagnostic settings to centralize audit events (verify available categories).<\/li>\n<li>Track \u201cwho connected to what\u201d via Azure Activity Log (resource operations) and Bastion logs where available.<\/li>\n<li>Use tags on Bastion resources for cost allocation (environment, owner, cost center).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Simple architecture diagram (conceptual)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  U[Admin User] --&gt;|HTTPS 443 (Portal)| P[Azure Portal]\n  P --&gt;|Session to Bastion| B[Azure Bastion\\nin AzureBastionSubnet]\n  B --&gt;|RDP 3389 \/ SSH 22 (Private IP)| VM[Private VM\\n(no Public IP)]\n  subgraph VNet[Azure Virtual Network]\n    B\n    VM\n  end\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Production-style architecture diagram (hub\/spoke + governance)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph Internet[User Network \/ Internet]\n    U1[Admin\/SRE Workstation]\n  end\n\n  U1 --&gt;|HTTPS 443| A[Azure Portal \/ Azure Control Plane]\n\n  subgraph HubVNet[Hub VNet]\n    B[Azure Bastion\\nAzureBastionSubnet]\n    F[Azure Firewall (optional)]\n    LA[Log Analytics Workspace]\n  end\n\n  subgraph SpokeVNet1[Spoke VNet: App]\n    VM1[App VM (private)]\n    VM2[DB VM (private)]\n  end\n\n  subgraph Governance[Governance]\n    POL[Azure Policy\\n(no public IPs, tagging)]\n    RBAC[Azure RBAC \/ PIM (optional)]\n  end\n\n  A --&gt; B\n  B --&gt;|RDP\/SSH private| VM1\n  B --&gt;|RDP\/SSH private| VM2\n\n  B --&gt;|Diagnostics| LA\n  POL --&gt; HubVNet\n  POL --&gt; SpokeVNet1\n  RBAC --&gt; A\n\n  HubVNet ---|VNet Peering \/ Routing| SpokeVNet1\n<\/code><\/pre>\n\n\n\n<p>Notes:\n&#8211; Whether Bastion can connect across peering and under what conditions depends on SKU\/features and configuration\u2014<strong>verify in official docs<\/strong>.\n&#8211; Azure Firewall is optional and shown for broader network governance; Bastion does not replace firewalling.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Account\/subscription\/tenant requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An active <strong>Azure subscription<\/strong> with permission to create networking and compute resources.<\/li>\n<li>If your org uses centralized networking, ensure you\u2019re allowed to create:<\/li>\n<li>VNets and subnets<\/li>\n<li>Public IPs<\/li>\n<li>Azure Bastion resource<\/li>\n<li>VMs and NICs<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM roles<\/h3>\n\n\n\n<p>At minimum, you typically need:\n&#8211; Permissions to create and manage <strong>Virtual Network<\/strong>, <strong>Subnets<\/strong>, <strong>Public IP<\/strong>, and <strong>Bastion<\/strong> resources.\n&#8211; Permissions to create\/manage <strong>VMs<\/strong>.\n&#8211; Permissions to <strong>connect<\/strong> using Bastion and to log into the VM OS.<\/p>\n\n\n\n<p>Exact RBAC actions required to initiate Bastion connections can be specific (for example, Bastion resource actions and VM read permissions). <strong>Verify the required RBAC roles and actions in official docs<\/strong>:\n&#8211; Azure Bastion documentation: https:\/\/learn.microsoft.com\/azure\/bastion\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Billing requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Azure Bastion is a paid service.<\/li>\n<li>VMs, disks, public IPs, and logging destinations also incur costs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Tools needed<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Azure portal access<\/li>\n<li>Azure CLI (optional but recommended for repeatable labs): https:\/\/learn.microsoft.com\/cli\/azure\/install-azure-cli<\/li>\n<li>SSH client (for Linux VM validation), or a browser-only approach via portal<\/li>\n<\/ul>\n\n\n\n<p>For CLI-based Bastion connectivity, you may need an Azure CLI extension depending on CLI version\u2014<strong>verify in official docs<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Azure Bastion is available in many Azure regions, but not all features\/SKUs are available everywhere.<\/li>\n<li>Always confirm region support: https:\/\/learn.microsoft.com\/azure\/bastion\/<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits<\/h3>\n\n\n\n<p>Common constraints to plan for (verify current limits):\n&#8211; <code>AzureBastionSubnet<\/code> must meet minimum size requirements (often <code>\/26<\/code>).\n&#8211; One Bastion resource is deployed per VNet (sharing models exist for connected networks depending on SKU\/features\u2014verify).\n&#8211; Concurrent session limits and scaling behavior depend on SKU.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Azure Virtual Network<\/li>\n<li>Dedicated <code>AzureBastionSubnet<\/code><\/li>\n<li>Azure Public IP (for the Bastion endpoint)<\/li>\n<li>One or more target VMs without public IP (recommended)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<p>Azure Bastion pricing is <strong>usage-based<\/strong> and depends on:\n&#8211; <strong>SKU<\/strong> (commonly Basic vs Standard)\n&#8211; <strong>Hourly rate<\/strong> for the Bastion resource (often per deployment\/unit; exact model can vary)\n&#8211; <strong>Data transfer \/ outbound data processing<\/strong> (Bastion traffic can incur data-related charges)\n&#8211; Optional related costs: Log Analytics ingestion, Storage for logs, VM compute and disks, Public IP, and any egress through firewalls\/NAT<\/p>\n\n\n\n<p>Because Azure pricing is <strong>region-dependent<\/strong> and changes over time, do not rely on static numbers in articles. Use the official sources:\n&#8211; Official pricing page: https:\/\/azure.microsoft.com\/pricing\/details\/azure-bastion\/\n&#8211; Azure Pricing Calculator: https:\/\/azure.microsoft.com\/pricing\/calculator\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions (what you pay for)<\/h3>\n\n\n\n<p>Expect the cost model to include:\n&#8211; <strong>Bastion host hours<\/strong>: running time of the Bastion deployment.\n&#8211; <strong>Data processed<\/strong>: traffic through Bastion (RDP\/SSH sessions) may be billed per GB (verify exact dimension on the pricing page).\n&#8211; <strong>SKU choice<\/strong>: Standard typically costs more than Basic due to additional features and scale characteristics.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Free tier<\/h3>\n\n\n\n<p>Azure Bastion generally does <strong>not<\/strong> have a free tier for sustained usage. Promotions may exist occasionally\u2014<strong>verify on the pricing page<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Primary cost drivers<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Leaving Bastion running<\/strong> continuously in dev\/test subscriptions.<\/li>\n<li><strong>Choosing Standard SKU<\/strong> for environments that only need Basic capabilities.<\/li>\n<li><strong>High session usage<\/strong> and heavy data transfer (file copy, large terminal output, long RDP sessions).<\/li>\n<li><strong>Centralized logging<\/strong> (Log Analytics ingestion and retention can exceed Bastion costs in some environments).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Hidden\/indirect costs to watch<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Log Analytics<\/strong>: diagnostics and activity logs routed to Log Analytics incur ingestion and retention costs.<\/li>\n<li><strong>Public IP<\/strong>: typically small cost but still billable.<\/li>\n<li><strong>VM uptime<\/strong>: Bastion often makes it easier to keep \u201cjust in case\u201d VMs running; ensure you deallocate lab VMs when not used.<\/li>\n<li><strong>Firewall\/NVA routing<\/strong>: if your design forces Bastion or VM traffic through a firewall, you may add data processing charges there too (architecture-dependent).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network\/data transfer implications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Bastion sessions involve continuous interactive traffic; RDP can be data-heavy depending on resolution\/graphics.<\/li>\n<li>If you use file transfer features (where supported), data volume increases.<\/li>\n<li>Cross-region scenarios (if applicable) can trigger inter-region bandwidth costs\u2014avoid cross-region admin paths.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How to optimize cost<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Right-size SKU<\/strong>: Use Basic where it meets requirements; use Standard only where needed (features\/concurrency).<\/li>\n<li><strong>Use Bastion per environment<\/strong> (prod vs non-prod) and remove it from temporary sandboxes.<\/li>\n<li><strong>Control logging<\/strong>: send only necessary logs; set retention appropriately.<\/li>\n<li><strong>Use VM auto-shutdown<\/strong> in dev\/test; deallocate VMs when idle.<\/li>\n<li>Consider whether a subset of environments can rely on <strong>VPN<\/strong> for admin access and reserve Bastion for high-security\/limited-access segments (depends on policy).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (qualitative)<\/h3>\n\n\n\n<p>A low-cost lab typically includes:\n&#8211; 1 small Linux VM (B-series)\n&#8211; 1 Bastion (Basic SKU if appropriate)\n&#8211; Minimal logging (or disabled in lab)\n&#8211; No VPN\/ExpressRoute<\/p>\n\n\n\n<p>To estimate:\n1. Open the pricing calculator.\n2. Add <strong>Azure Bastion<\/strong> with your region and SKU.\n3. Add <strong>Virtual Machines<\/strong> (compute + OS disk).\n4. Add <strong>Public IP<\/strong> and <strong>Log Analytics<\/strong> only if enabled.\n5. Multiply by hours used (for example, a few hours for a lab vs 730 hours\/month for always-on).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations (what to model)<\/h3>\n\n\n\n<p>In production, model:\n&#8211; Bastion SKU needed (often Standard if advanced features are required)\n&#8211; Expected concurrent sessions (ops + vendors + on-call)\n&#8211; Data processed per month (RDP heavy vs SSH light)\n&#8211; Logging destination and retention (SIEM requirements)\n&#8211; Whether you need Bastion per VNet\/spoke vs shared pattern (verify supported designs)\n&#8211; Cost allocation via tags and chargeback<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Deploy Azure Bastion in a new VNet, create a private Linux VM with <strong>no public IP<\/strong>, and connect to it via Azure Bastion using secure SSH.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:\n1. Create a resource group.\n2. Create a VNet with two subnets:\n   &#8211; <code>workloads<\/code> subnet for the VM\n   &#8211; <code>AzureBastionSubnet<\/code> dedicated subnet for Bastion\n3. Create a Linux VM without a public IP.\n4. Deploy Azure Bastion with a public IP.\n5. Connect to the VM through Bastion and validate private-only access.\n6. Clean up all resources.<\/p>\n\n\n\n<p>This lab is designed to be <strong>beginner-friendly<\/strong> and <strong>low-risk<\/strong>, but Azure Bastion is a paid service\u2014remember to clean up.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Create a resource group<\/h3>\n\n\n\n<p><strong>Option A: Azure CLI<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Sign in:<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">az login\n<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"2\">\n<li>Set your subscription (if needed):<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">az account set --subscription \"&lt;SUBSCRIPTION_ID_OR_NAME&gt;\"\n<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"3\">\n<li>Create a resource group:<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">az group create \\\n  --name rg-bastion-lab \\\n  --location eastus\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong> Resource group <code>rg-bastion-lab<\/code> exists in your chosen region.<\/p>\n\n\n\n<p><strong>Verification:<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">az group show --name rg-bastion-lab --output table\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Create a VNet and subnets (including AzureBastionSubnet)<\/h3>\n\n\n\n<p>Azure Bastion requires a dedicated subnet named <strong>exactly<\/strong> <code>AzureBastionSubnet<\/code>. The subnet must be large enough (commonly <code>\/26<\/code> minimum; verify current requirement).<\/p>\n\n\n\n<p>Create the VNet and a workload subnet:<\/p>\n\n\n\n<pre><code class=\"language-bash\">az network vnet create \\\n  --resource-group rg-bastion-lab \\\n  --location eastus \\\n  --name vnet-bastion-lab \\\n  --address-prefixes 10.10.0.0\/16 \\\n  --subnet-name workloads \\\n  --subnet-prefixes 10.10.1.0\/24\n<\/code><\/pre>\n\n\n\n<p>Create the Bastion subnet:<\/p>\n\n\n\n<pre><code class=\"language-bash\">az network vnet subnet create \\\n  --resource-group rg-bastion-lab \\\n  --vnet-name vnet-bastion-lab \\\n  --name AzureBastionSubnet \\\n  --address-prefixes 10.10.0.0\/26\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; VNet <code>vnet-bastion-lab<\/code> exists\n&#8211; Subnet <code>workloads<\/code> exists\n&#8211; Subnet <code>AzureBastionSubnet<\/code> exists with a <code>\/26<\/code><\/p>\n\n\n\n<p><strong>Verification:<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">az network vnet subnet list \\\n  --resource-group rg-bastion-lab \\\n  --vnet-name vnet-bastion-lab \\\n  --output table\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Create a private Linux VM (no public IP)<\/h3>\n\n\n\n<p>Create (or reuse) an SSH key locally:<\/p>\n\n\n\n<pre><code class=\"language-bash\">ssh-keygen -t ed25519 -f ~\/.ssh\/bastionlab_ed25519 -N \"\"\n<\/code><\/pre>\n\n\n\n<p>Create the VM without a public IP:<\/p>\n\n\n\n<pre><code class=\"language-bash\">az vm create \\\n  --resource-group rg-bastion-lab \\\n  --name vm-linux-private \\\n  --location eastus \\\n  --image Ubuntu2204 \\\n  --size Standard_B1s \\\n  --vnet-name vnet-bastion-lab \\\n  --subnet workloads \\\n  --public-ip-address \"\" \\\n  --admin-username azureuser \\\n  --ssh-key-values ~\/.ssh\/bastionlab_ed25519.pub\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong> A VM is created in the <code>workloads<\/code> subnet and has <strong>no public IP<\/strong>.<\/p>\n\n\n\n<p><strong>Verification (confirm no public IP):<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">az vm list-ip-addresses \\\n  --resource-group rg-bastion-lab \\\n  --name vm-linux-private \\\n  --output table\n<\/code><\/pre>\n\n\n\n<p>You should see a private IP and an empty\/none public IP entry.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Create a Public IP for Azure Bastion<\/h3>\n\n\n\n<p>Azure Bastion typically requires a <strong>Standard<\/strong> Public IP SKU (verify current requirement in docs if you hit errors).<\/p>\n\n\n\n<pre><code class=\"language-bash\">az network public-ip create \\\n  --resource-group rg-bastion-lab \\\n  --name pip-bastion-lab \\\n  --location eastus \\\n  --sku Standard \\\n  --allocation-method Static\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong> Public IP resource <code>pip-bastion-lab<\/code> exists.<\/p>\n\n\n\n<p><strong>Verification:<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">az network public-ip show \\\n  --resource-group rg-bastion-lab \\\n  --name pip-bastion-lab \\\n  --query \"{ipAddress:ipAddress, sku:sku.name}\" \\\n  --output table\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Deploy Azure Bastion into the VNet<\/h3>\n\n\n\n<p>Create the Bastion resource:<\/p>\n\n\n\n<pre><code class=\"language-bash\">az network bastion create \\\n  --resource-group rg-bastion-lab \\\n  --name bastion-lab \\\n  --location eastus \\\n  --vnet-name vnet-bastion-lab \\\n  --public-ip-address pip-bastion-lab\n<\/code><\/pre>\n\n\n\n<p>If you need a specific SKU (Basic\/Standard), check <code>az network bastion create --help<\/code> and the current docs; flags and defaults can vary by CLI version. <strong>Verify SKU parameters in official docs<\/strong>:\nhttps:\/\/learn.microsoft.com\/azure\/bastion\/<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong> Bastion is deployed successfully in <code>AzureBastionSubnet<\/code>.<\/p>\n\n\n\n<p><strong>Verification:<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">az network bastion show \\\n  --resource-group rg-bastion-lab \\\n  --name bastion-lab \\\n  --output table\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Connect to the VM using Azure Bastion (Portal method)<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the Azure portal: https:\/\/portal.azure.com<\/li>\n<li>Navigate to <strong>Virtual machines<\/strong> \u2192 <strong>vm-linux-private<\/strong><\/li>\n<li>Select <strong>Connect<\/strong> \u2192 <strong>Bastion<\/strong><\/li>\n<li>Enter:\n   &#8211; Username: <code>azureuser<\/code>\n   &#8211; Authentication: SSH private key (paste contents of <code>~\/.ssh\/bastionlab_ed25519<\/code>)<\/li>\n<li>Click <strong>Connect<\/strong><\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You get an interactive SSH terminal session in the browser, connected to the VM\u2019s private IP.<\/p>\n\n\n\n<p><strong>Verification inside the VM:<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">ip a\nhostname\n<\/code><\/pre>\n\n\n\n<p>You should see the VM\u2019s private IP in the <code>10.10.1.0\/24<\/code> range.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7 (Optional): Connect using Azure CLI (native SSH via Bastion)<\/h3>\n\n\n\n<p>Azure supports CLI-driven Bastion connectivity. Depending on your Azure CLI version, this may require an extension.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Check CLI version:<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">az version\n<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"2\">\n<li>If documentation instructs, install the Bastion extension (only if required):<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">az extension add --name bastion\n<\/code><\/pre>\n\n\n\n<p>If this fails, don\u2019t force it\u2014use the portal method and <strong>verify the current CLI requirements<\/strong> in official docs.<\/p>\n\n\n\n<ol class=\"wp-block-list\" start=\"3\">\n<li>Get the VM resource ID:<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">VM_ID=$(az vm show -g rg-bastion-lab -n vm-linux-private --query id -o tsv)\necho \"$VM_ID\"\n<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"4\">\n<li>Attempt SSH via Bastion (command shape may vary; verify in docs):<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">az network bastion ssh \\\n  --name bastion-lab \\\n  --resource-group rg-bastion-lab \\\n  --target-resource-id \"$VM_ID\" \\\n  --auth-type ssh-key \\\n  --username azureuser \\\n  --ssh-key ~\/.ssh\/bastionlab_ed25519\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong> Your local terminal opens an SSH session to the VM through Bastion.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>Confirm:\n1. <strong>VM has no public IP<\/strong>:<\/p>\n\n\n\n<pre><code class=\"language-bash\">az vm list-ip-addresses -g rg-bastion-lab -n vm-linux-private -o table\n<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"2\">\n<li><strong>Bastion exists and is running<\/strong>:<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">az network bastion show -g rg-bastion-lab -n bastion-lab -o table\n<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"3\">\n<li>\n<p><strong>You can reach the VM via Bastion<\/strong>:\n&#8211; Portal SSH session opens successfully, or CLI-based SSH works.<\/p>\n<\/li>\n<li>\n<p><strong>No inbound internet rules are needed on the VM subnet<\/strong> for SSH:\n&#8211; Your VM subnet NSG (if present) should not allow inbound from <code>Internet<\/code> to port 22.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<p>Common issues and fixes:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Bastion deployment fails due to subnet name<\/strong>\n&#8211; Symptom: Error mentions required subnet name.\n&#8211; Fix: Ensure the subnet is named <strong>exactly<\/strong> <code>AzureBastionSubnet<\/code> (case-sensitive in practice\u2014follow docs).<\/p>\n<\/li>\n<li>\n<p><strong>Bastion deployment fails due to subnet size<\/strong>\n&#8211; Symptom: Error indicates subnet too small.\n&#8211; Fix: Use at least <code>\/26<\/code> for <code>AzureBastionSubnet<\/code> (verify current requirement).<\/p>\n<\/li>\n<li>\n<p><strong>Public IP SKU mismatch<\/strong>\n&#8211; Symptom: Error about Public IP SKU.\n&#8211; Fix: Recreate the Bastion public IP as <strong>Standard<\/strong> SKU and retry.<\/p>\n<\/li>\n<li>\n<p><strong>Cannot connect to VM via Bastion<\/strong>\n&#8211; Check VM is running:<\/p>\n<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">az vm get-instance-view -g rg-bastion-lab -n vm-linux-private --query instanceView.statuses -o table\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Check NSGs: ensure the VM subnet NSG allows SSH from the Bastion subnet CIDR (or at least allows VNet traffic). If you tightened rules, explicitly allow inbound from <code>10.10.0.0\/26<\/code> to TCP\/22.<\/li>\n<li>Check VM firewall (ufw\/iptables) allows SSH.<\/li>\n<\/ul>\n\n\n\n<ol class=\"wp-block-list\" start=\"5\">\n<li><strong>CLI Bastion commands not found<\/strong>\n&#8211; Symptom: <code>az network bastion ssh<\/code> not recognized.\n&#8211; Fix: Update Azure CLI and verify whether an extension is required. Use portal method in the meantime. Official docs: https:\/\/learn.microsoft.com\/azure\/bastion\/<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To avoid ongoing charges, delete the resource group (this removes Bastion, VM, public IPs, and VNet):<\/p>\n\n\n\n<pre><code class=\"language-bash\">az group delete --name rg-bastion-lab --yes --no-wait\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong> All lab resources are scheduled for deletion.<\/p>\n\n\n\n<p>Verify deletion:<\/p>\n\n\n\n<pre><code class=\"language-bash\">az group exists --name rg-bastion-lab\n<\/code><\/pre>\n\n\n\n<p>It should return <code>false<\/code> after deletion completes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Design for \u201cprivate by default\u201d<\/strong>: Put VMs on private subnets without public IPs; use Bastion for interactive access.<\/li>\n<li><strong>Use hub-and-spoke carefully<\/strong>: Decide whether Bastion is per-spoke or centralized. Validate peering and connectivity support for your chosen SKU and design.<\/li>\n<li><strong>Segment admin paths<\/strong>: Restrict VM management ports to only allow traffic from the Bastion subnet CIDR.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Least privilege via RBAC<\/strong>: Grant only the ability to connect to required VMs; avoid broad contributor rights.<\/li>\n<li><strong>Separate duties<\/strong>: Network team manages Bastion\/VNet; ops team gets connect rights; security team audits logs.<\/li>\n<li><strong>Use time-bound privileged access<\/strong> where your organization supports it (for example, privileged identity workflows). Exact implementation depends on your identity platform.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Remove Bastion from short-lived sandboxes<\/strong> once testing is complete.<\/li>\n<li><strong>Choose SKU intentionally<\/strong>: Don\u2019t pay for Standard features you don\u2019t use.<\/li>\n<li><strong>Right-size logging<\/strong>: Route diagnostics to the right destination with appropriate retention.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prefer <strong>SSH<\/strong> for lightweight administration when possible (lower bandwidth than RDP).<\/li>\n<li>For RDP, keep resolution reasonable and avoid unnecessary graphical workloads through Bastion.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Consider how admins will access systems if the Azure portal is unavailable (document fallback processes).<\/li>\n<li>Maintain <strong>break-glass accounts<\/strong> and documented runbooks, consistent with your security policies.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable <strong>diagnostic settings<\/strong> and centralize logs.<\/li>\n<li>Use <strong>naming standards<\/strong> (include env\/region): <code>bas-&lt;env&gt;-&lt;region&gt;-01<\/code><\/li>\n<li>Use tagging: <code>env<\/code>, <code>owner<\/code>, <code>costCenter<\/code>, <code>dataClassification<\/code>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enforce \u201cno public IPs on NICs\u201d and \u201capproved SKUs only\u201d via Azure Policy (where feasible).<\/li>\n<li>Tag Bastion resources for chargeback; Bastion is a shared access cost that can otherwise be hard to allocate.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Azure authentication<\/strong>: Access starts with Azure sign-in.<\/li>\n<li><strong>Azure RBAC authorization<\/strong>: Controls who can initiate Bastion sessions and who can access VM resources.<\/li>\n<li><strong>OS-level authentication<\/strong>: Users still authenticate to the VM (SSH keys, local accounts, or supported identity-based login where configured). Validate which identity-based login methods are supported for your OS and Bastion connection mode.<\/li>\n<\/ul>\n\n\n\n<p>Recommendations:\n&#8211; Use <strong>individual identities<\/strong>, not shared VM accounts.\n&#8211; Prefer <strong>SSH keys<\/strong> over passwords for Linux.\n&#8211; For Windows, prefer strong credential hygiene and consider identity-integrated login methods where supported (verify prerequisites).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Client-to-Bastion traffic is encrypted (TLS\/HTTPS).<\/li>\n<li>Bastion-to-VM traffic occurs over private networking; encryption depends on protocol (SSH is encrypted; RDP has encryption options).<\/li>\n<li>Disk encryption and VM-level encryption remain your responsibility (Azure Disk Encryption \/ server-side encryption options).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Target VMs can be fully private (no public IPs).<\/li>\n<li>Bastion itself uses a public IP endpoint (service-managed). Treat it as a controlled ingress point:<\/li>\n<li>Lock down who can use it via RBAC.<\/li>\n<li>Follow NSG requirements if you associate NSGs to Bastion subnet (misconfiguration can break service).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Avoid pasting private keys into shared machines.<\/li>\n<li>Prefer secure key storage and rotation processes (for example, enterprise key management).<\/li>\n<li>Don\u2019t store SSH private keys in source control or shared file shares.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use:<\/li>\n<li><strong>Azure Activity Log<\/strong> for control-plane events (creation\/updates of Bastion, role assignments).<\/li>\n<li><strong>Azure Monitor diagnostic logs<\/strong> for Bastion where supported.<\/li>\n<li>Forward logs to SIEM (Microsoft Sentinel or third-party) if required.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Bastion helps reduce public exposure, supporting common compliance controls (minimize ingress, least privilege).<\/li>\n<li>Compliance is not automatic: you still must implement RBAC, logging, secure VM baselines, patching, and vulnerability management.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Leaving <strong>public IPs<\/strong> on VMs \u201ctemporarily\u201d and never removing them.<\/li>\n<li>Granting <strong>Owner\/Contributor<\/strong> widely so many users can connect everywhere.<\/li>\n<li>Misconfiguring NSGs so Bastion connectivity fails, leading teams to re-add public IPs as a workaround.<\/li>\n<li>Not logging or not reviewing access patterns.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Deploy Bastion as part of a <strong>standard landing zone<\/strong> pattern.<\/li>\n<li>Enforce \u201cno public IP on VM NIC\u201d via policy where possible.<\/li>\n<li>Restrict RDP\/SSH on VM subnets to <strong>only<\/strong> Bastion subnet CIDR.<\/li>\n<li>Centralize logs and run regular access reviews.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<p>Always confirm the latest constraints in official docs, but plan for these common gotchas:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Subnet requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>AzureBastionSubnet<\/code> must be named exactly and meet minimum sizing (commonly <code>\/26<\/code>).<\/li>\n<li>Subnet IP exhaustion can occur if you undersize and later need scale\/features\u2014plan ahead.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">NSG and route table pitfalls<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Attaching an NSG to <code>AzureBastionSubnet<\/code> without required rules can break Bastion.<\/li>\n<li>User-defined routes (UDRs) can interfere with connectivity if they force traffic in unsupported ways. Test carefully in secured hub\/spoke networks.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">SKU feature mismatches<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Some advanced capabilities (native client support, file transfer, custom ports, peering scenarios) are often SKU-dependent.<\/li>\n<li>Picking Basic for production and then needing Standard features later can cause rework.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Public endpoint perception<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Even though VMs are private, Bastion uses a public IP. Some organizations require \u201cno public endpoints at all,\u201d which may require alternative designs or additional controls.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational behaviors<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Browser-based sessions depend on portal availability and client network policies.<\/li>\n<li>Long-running sessions can be disrupted by network changes or corporate proxy behavior.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compatibility issues<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Custom SSH\/RDP ports and certain authentication modes may require specific SKUs or configuration (verify).<\/li>\n<li>Hardened VM firewall baselines can unintentionally block Bastion-to-VM traffic.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing surprises<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Leaving Bastion running in multiple dev\/test VNets can create steady monthly cost.<\/li>\n<li>Diagnostics routed to Log Analytics can generate ingestion cost if verbose.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Migration challenges<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Migrating from jump box VMs often requires:<\/li>\n<li>Removing public IPs<\/li>\n<li>Adjusting NSGs<\/li>\n<li>Updating runbooks and access processes<\/li>\n<li>Training teams on the new access flow<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<p>Azure Bastion is one option for secure administrative access. The best choice depends on whether you need interactive access, full network connectivity, or agent-based management.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Comparison table<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Azure Bastion<\/strong><\/td>\n<td>Secure RDP\/SSH to private VMs<\/td>\n<td>No public IPs on VMs; managed service; Azure RBAC integration; quick setup<\/td>\n<td>Ongoing cost; feature set varies by SKU; still a public endpoint for Bastion<\/td>\n<td>You need standardized, secure interactive VM access without VPN<\/td>\n<\/tr>\n<tr>\n<td><strong>Self-managed jump box VM<\/strong><\/td>\n<td>Custom admin tooling and full control<\/td>\n<td>Full OS control; can install tools; can be cheaper for very small scale (sometimes)<\/td>\n<td>You patch\/harden\/monitor it; often ends up with public exposure; single point of failure if not HA<\/td>\n<td>You need custom tooling on the jump host and accept operational overhead<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure VPN Gateway<\/strong><\/td>\n<td>Full private network access from admin devices<\/td>\n<td>Broad access to private subnets; works for many protocols<\/td>\n<td>Requires client VPN management; expands network trust boundary; still needs good endpoint hygiene<\/td>\n<td>You need network-level access to many resources beyond VM RDP\/SSH<\/td>\n<\/tr>\n<tr>\n<td><strong>ExpressRoute<\/strong><\/td>\n<td>Private connectivity from corporate networks<\/td>\n<td>High reliability; private circuit; enterprise standard<\/td>\n<td>Cost and lead time; still requires internal network governance<\/td>\n<td>Enterprise connectivity needs and strict private routing requirements<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure Virtual Desktop (AVD)<\/strong><\/td>\n<td>Secure desktop\/app delivery<\/td>\n<td>Strong user experience; centralized desktops; can integrate with identity controls<\/td>\n<td>More complex; different goal than VM admin access; cost<\/td>\n<td>You need user desktops or controlled admin workstations inside Azure<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Systems Manager Session Manager<\/strong> (other cloud)<\/td>\n<td>Agent-based shell access without inbound ports<\/td>\n<td>No inbound network exposure; strong auditing<\/td>\n<td>Different cloud; requires SSM agent and IAM; not RDP equivalent by default<\/td>\n<td>Multi-cloud comparison: when you want agent-based access patterns<\/td>\n<\/tr>\n<tr>\n<td><strong>Google Cloud IAP TCP forwarding<\/strong> (other cloud)<\/td>\n<td>Identity-aware access to private resources<\/td>\n<td>Identity-aware proxying<\/td>\n<td>Different cloud; requires IAP setup<\/td>\n<td>Multi-cloud comparison for identity-aware access<\/td>\n<\/tr>\n<tr>\n<td><strong>Apache Guacamole \/ OSS bastion<\/strong><\/td>\n<td>Browser-based RDP\/SSH via self-managed gateway<\/td>\n<td>Flexible; self-hosted; can integrate with many systems<\/td>\n<td>You manage it; HA and security are your responsibility<\/td>\n<td>You need custom workflows and accept managing the platform<\/td>\n<\/tr>\n<tr>\n<td><strong>Privileged Access Management (PAM) tools<\/strong><\/td>\n<td>Strong governance, approvals, recording<\/td>\n<td>Mature controls: approvals, rotation, auditing<\/td>\n<td>Cost and complexity; integration work<\/td>\n<td>Regulated environments requiring approvals\/recording\/rotation<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: regulated hub-and-spoke network<\/h3>\n\n\n\n<p><strong>Problem<\/strong>\nA financial services company hosts hundreds of Windows and Linux VMs across multiple spokes. Security policy forbids inbound internet access to workload subnets and mandates removal of VM public IPs. Operations teams still need RDP\/SSH for patching and incident response.<\/p>\n\n\n\n<p><strong>Proposed architecture<\/strong>\n&#8211; Hub-and-spoke VNets with centralized network governance\n&#8211; Azure Bastion deployed per environment (or centrally if supported\/approved by SKU and design)\n&#8211; VM subnets with NSGs allowing RDP\/SSH only from <code>AzureBastionSubnet<\/code> CIDR\n&#8211; Azure Policy enforcing:\n  &#8211; No public IP on VM NICs\n  &#8211; Required tags and approved regions\/SKUs\n&#8211; Azure Monitor diagnostics forwarded to Log Analytics and SIEM<\/p>\n\n\n\n<p><strong>Why Azure Bastion was chosen<\/strong>\n&#8211; Eliminates VM public IPs and inbound 3389\/22 exposure\n&#8211; Simplifies admin access without rolling out VPN to every third-party operator\n&#8211; Aligns with RBAC and centralized auditing<\/p>\n\n\n\n<p><strong>Expected outcomes<\/strong>\n&#8211; Reduced attack surface and scanning noise\n&#8211; More consistent operational access method\n&#8211; Better audit trail of access tooling (control-plane and diagnostic logs)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: secure access without a VPN rollout<\/h3>\n\n\n\n<p><strong>Problem<\/strong>\nA startup runs a few Linux VMs for a legacy workload. They want to keep servers private and avoid maintaining a jump box VM or managing a VPN client for every engineer.<\/p>\n\n\n\n<p><strong>Proposed architecture<\/strong>\n&#8211; Single VNet with private VM subnet\n&#8211; Azure Bastion in <code>AzureBastionSubnet<\/code>\n&#8211; No public IP on VMs\n&#8211; Minimal NSG rules and basic logging\n&#8211; Tags for cost tracking<\/p>\n\n\n\n<p><strong>Why Azure Bastion was chosen<\/strong>\n&#8211; Fast to deploy\n&#8211; Avoids maintaining a jump VM\n&#8211; Engineers can access VMs securely from the portal when needed<\/p>\n\n\n\n<p><strong>Expected outcomes<\/strong>\n&#8211; Private VMs with secure SSH access\n&#8211; Less ops burden\n&#8211; Clear path to scale into stronger governance later (policy, logging, approvals)<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<p>1) <strong>Do my VMs need public IP addresses to use Azure Bastion?<\/strong><br\/>\nNo. A primary benefit of Azure Bastion is enabling RDP\/SSH to VMs over private IPs without public IPs on the VMs.<\/p>\n\n\n\n<p>2) <strong>Does Azure Bastion replace a VPN?<\/strong><br\/>\nNot exactly. Bastion is primarily for interactive RDP\/SSH access to VMs. A VPN provides broader network-level access to private subnets for many protocols.<\/p>\n\n\n\n<p>3) <strong>What subnet does Azure Bastion require?<\/strong><br\/>\nA dedicated subnet named <code>AzureBastionSubnet<\/code>. It must meet minimum size requirements (commonly <code>\/26<\/code>). Verify current sizing in official docs.<\/p>\n\n\n\n<p>4) <strong>Can I apply an NSG to AzureBastionSubnet?<\/strong><br\/>\nSometimes, but you must follow Azure\u2019s required inbound\/outbound rules for Bastion. Misconfigured NSGs commonly break connectivity. Verify required rules in official docs.<\/p>\n\n\n\n<p>5) <strong>What ports do I need to open to the internet for my VMs?<\/strong><br\/>\nTypically none for RDP\/SSH when using Bastion (VMs remain private). Bastion itself is accessed over HTTPS (commonly 443).<\/p>\n\n\n\n<p>6) <strong>Can Bastion connect to VMs in peered VNets?<\/strong><br\/>\nThis depends on SKU\/features and configuration. Verify current support and requirements in official docs before designing around it.<\/p>\n\n\n\n<p>7) <strong>Does Azure Bastion support Linux and Windows?<\/strong><br\/>\nYes\u2014SSH for Linux and RDP for Windows are the core use cases.<\/p>\n\n\n\n<p>8) <strong>How do users authenticate?<\/strong><br\/>\nUsers authenticate to Azure (Entra ID\/Azure AD). They still authenticate to the VM OS using SSH keys\/credentials or supported identity-based login methods on the VM (verify supported scenarios).<\/p>\n\n\n\n<p>9) <strong>Is Azure Bastion highly available by default?<\/strong><br\/>\nAzure manages the service, but availability characteristics depend on region and SKU. Verify official SLA\/architecture guidance.<\/p>\n\n\n\n<p>10) <strong>Can I use my native SSH or RDP client instead of the portal?<\/strong><br\/>\nIn many cases, yes via supported native client options\/tunneling (often SKU-dependent and CLI-assisted). Verify current requirements and supported clients.<\/p>\n\n\n\n<p>11) <strong>Does Bastion support custom SSH\/RDP ports?<\/strong><br\/>\nThis is commonly an advanced feature and may require specific SKU. Verify current support and limitations.<\/p>\n\n\n\n<p>12) <strong>Can I transfer files through Bastion?<\/strong><br\/>\nFile transfer is SKU\/feature-dependent. Verify current support and consider data loss prevention and auditing requirements.<\/p>\n\n\n\n<p>13) <strong>What should I log for compliance?<\/strong><br\/>\nAt minimum: Azure Activity Log (resource operations) and Bastion diagnostic logs\/metrics where available, forwarded to a central workspace or SIEM. Also log OS-level authentication and command\/activity on the VM.<\/p>\n\n\n\n<p>14) <strong>How do I prevent teams from adding public IPs again?<\/strong><br\/>\nUse Azure Policy to deny public IP creation\/association on VM NICs, combined with Bastion as the approved access method.<\/p>\n\n\n\n<p>15) <strong>What\u2019s the simplest safe pattern for dev\/test?<\/strong><br\/>\nOne VNet, private VM subnet, <code>AzureBastionSubnet<\/code>, Bastion Basic SKU (if it meets needs), minimal logging, and strict cleanup of resources after use.<\/p>\n\n\n\n<p>16) <strong>Does Azure Bastion inspect traffic or replace a firewall?<\/strong><br\/>\nNo. Bastion is an access proxy for RDP\/SSH. You still need NSGs\/firewalls for network security and segmentation.<\/p>\n\n\n\n<p>17) <strong>Can I use Bastion for automated configuration management (Ansible\/SSH automation)?<\/strong><br\/>\nBastion is designed for interactive access. Some native client\/tunneling options can support certain workflows, but for automation at scale, prefer agent-based tools or private network connectivity (VPN\/ExpressRoute) depending on your design. Verify supported automation patterns.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn Azure Bastion<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation<\/td>\n<td>Azure Bastion documentation \u2013 https:\/\/learn.microsoft.com\/azure\/bastion\/<\/td>\n<td>Authoritative setup, architecture, and feature\/SKU guidance<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>Azure Bastion pricing \u2013 https:\/\/azure.microsoft.com\/pricing\/details\/azure-bastion\/<\/td>\n<td>Current pricing dimensions by region\/SKU<\/td>\n<\/tr>\n<tr>\n<td>Pricing tool<\/td>\n<td>Azure Pricing Calculator \u2013 https:\/\/azure.microsoft.com\/pricing\/calculator\/<\/td>\n<td>Build estimates including Bastion + VM + logging<\/td>\n<\/tr>\n<tr>\n<td>Quickstarts\/Tutorials<\/td>\n<td>Search \u201cAzure Bastion quickstart\u201d within Microsoft Learn \u2013 https:\/\/learn.microsoft.com\/azure\/bastion\/<\/td>\n<td>Step-by-step deployment and connectivity walkthroughs<\/td>\n<\/tr>\n<tr>\n<td>Architecture guidance<\/td>\n<td>Azure Architecture Center \u2013 https:\/\/learn.microsoft.com\/azure\/architecture\/<\/td>\n<td>Broader networking and secure access patterns (hub\/spoke, landing zones)<\/td>\n<\/tr>\n<tr>\n<td>Security baseline<\/td>\n<td>Microsoft cloud security documentation \u2013 https:\/\/learn.microsoft.com\/security\/<\/td>\n<td>Helps align Bastion usage with security controls and governance<\/td>\n<\/tr>\n<tr>\n<td>Azure CLI reference<\/td>\n<td>Azure CLI docs \u2013 https:\/\/learn.microsoft.com\/cli\/azure\/<\/td>\n<td>Commands for repeatable networking\/VM setups<\/td>\n<\/tr>\n<tr>\n<td>Azure Policy docs<\/td>\n<td>Azure Policy documentation \u2013 https:\/\/learn.microsoft.com\/azure\/governance\/policy\/<\/td>\n<td>Enforce no-public-IP, tagging, allowed SKUs, and standards<\/td>\n<\/tr>\n<tr>\n<td>Video learning<\/td>\n<td>Microsoft Learn \/ Azure YouTube channel \u2013 https:\/\/www.youtube.com\/@MicrosoftAzure<\/td>\n<td>Visual walkthroughs and conceptual explanations (search Bastion)<\/td>\n<\/tr>\n<tr>\n<td>Community (trusted)<\/td>\n<td>Microsoft Tech Community (Azure Networking discussions) \u2013 https:\/\/techcommunity.microsoft.com\/<\/td>\n<td>Real-world troubleshooting patterns; validate against official docs<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>DevOpsSchool.com<\/strong><br\/>\n   &#8211; Suitable audience: DevOps engineers, SREs, cloud engineers, platform teams<br\/>\n   &#8211; Likely learning focus: Azure operations, DevOps practices, cloud networking fundamentals (verify specific Bastion coverage on site)<br\/>\n   &#8211; Mode: check website<br\/>\n   &#8211; Website: https:\/\/www.devopsschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>ScmGalaxy.com<\/strong><br\/>\n   &#8211; Suitable audience: DevOps beginners to intermediate practitioners<br\/>\n   &#8211; Likely learning focus: SCM, CI\/CD, DevOps foundations, cloud basics (verify Azure Networking topics on site)<br\/>\n   &#8211; Mode: check website<br\/>\n   &#8211; Website: https:\/\/www.scmgalaxy.com\/<\/p>\n<\/li>\n<li>\n<p><strong>CLoudOpsNow.in<\/strong><br\/>\n   &#8211; Suitable audience: Cloud operations and platform teams<br\/>\n   &#8211; Likely learning focus: CloudOps, operational tooling, monitoring, governance (verify Azure course catalog)<br\/>\n   &#8211; Mode: check website<br\/>\n   &#8211; Website: https:\/\/www.cloudopsnow.in\/<\/p>\n<\/li>\n<li>\n<p><strong>SreSchool.com<\/strong><br\/>\n   &#8211; Suitable audience: SREs, reliability engineers, operations teams<br\/>\n   &#8211; Likely learning focus: SRE practices, incident response, reliability patterns (verify Azure-specific offerings)<br\/>\n   &#8211; Mode: check website<br\/>\n   &#8211; Website: https:\/\/www.sreschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>AiOpsSchool.com<\/strong><br\/>\n   &#8211; Suitable audience: Ops teams adopting AIOps practices<br\/>\n   &#8211; Likely learning focus: Observability, automation, AIOps concepts (verify Azure integration content)<br\/>\n   &#8211; Mode: check website<br\/>\n   &#8211; Website: https:\/\/www.aiopsschool.com\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>RajeshKumar.xyz<\/strong><br\/>\n   &#8211; Likely specialization: DevOps \/ cloud training content (verify current offerings)<br\/>\n   &#8211; Suitable audience: Engineers seeking practical training and guidance<br\/>\n   &#8211; Website: https:\/\/rajeshkumar.xyz\/<\/p>\n<\/li>\n<li>\n<p><strong>devopstrainer.in<\/strong><br\/>\n   &#8211; Likely specialization: DevOps tooling and CI\/CD training (verify Azure modules)<br\/>\n   &#8211; Suitable audience: Beginners to intermediate DevOps practitioners<br\/>\n   &#8211; Website: https:\/\/www.devopstrainer.in\/<\/p>\n<\/li>\n<li>\n<p><strong>devopsfreelancer.com<\/strong><br\/>\n   &#8211; Likely specialization: DevOps consulting\/training resources (verify services)<br\/>\n   &#8211; Suitable audience: Teams seeking hands-on guidance or project-based help<br\/>\n   &#8211; Website: https:\/\/www.devopsfreelancer.com\/<\/p>\n<\/li>\n<li>\n<p><strong>devopssupport.in<\/strong><br\/>\n   &#8211; Likely specialization: DevOps support and training resources (verify scope)<br\/>\n   &#8211; Suitable audience: Ops\/DevOps teams needing practical support<br\/>\n   &#8211; Website: https:\/\/www.devopssupport.in\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>cotocus.com<\/strong><br\/>\n   &#8211; Likely service area: Cloud\/DevOps consulting (verify current service catalog)<br\/>\n   &#8211; Where they may help: Architecture reviews, implementations, operational readiness<br\/>\n   &#8211; Consulting use case examples: Secure VM access patterns, landing zone governance, network segmentation planning<br\/>\n   &#8211; Website: https:\/\/cotocus.com\/<\/p>\n<\/li>\n<li>\n<p><strong>DevOpsSchool.com<\/strong><br\/>\n   &#8211; Likely service area: DevOps and cloud consulting\/training (verify consulting offerings)<br\/>\n   &#8211; Where they may help: DevOps transformation, cloud migrations, platform engineering enablement<br\/>\n   &#8211; Consulting use case examples: Standardizing Azure Networking patterns, implementing Bastion-based access controls, building runbooks and governance<br\/>\n   &#8211; Website: https:\/\/www.devopsschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>DEVOPSCONSULTING.IN<\/strong><br\/>\n   &#8211; Likely service area: DevOps consulting services (verify current offerings)<br\/>\n   &#8211; Where they may help: CI\/CD, infrastructure automation, cloud operations<br\/>\n   &#8211; Consulting use case examples: Infrastructure-as-Code rollout for network and Bastion deployments, operational monitoring integration, access governance processes<br\/>\n   &#8211; Website: https:\/\/www.devopsconsulting.in\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before Azure Bastion<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Azure fundamentals<\/strong>: subscriptions, resource groups, IAM\/RBAC<\/li>\n<li><strong>Azure Networking basics<\/strong>:<\/li>\n<li>VNets, subnets, IP addressing<\/li>\n<li>NSGs, service tags (conceptually), routing<\/li>\n<li>Public IP vs private IP<\/li>\n<li><strong>VM fundamentals<\/strong>: Windows RDP, Linux SSH, authentication basics<\/li>\n<li><strong>Security basics<\/strong>: least privilege, audit logging, secure admin access patterns<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after Azure Bastion<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Hub-and-spoke networking<\/strong> and secure landing zones<\/li>\n<li><strong>Azure Firewall<\/strong> and advanced segmentation<\/li>\n<li><strong>VPN Gateway \/ ExpressRoute<\/strong> for private connectivity<\/li>\n<li><strong>Azure Monitor<\/strong> and SIEM integration (Microsoft Sentinel)<\/li>\n<li><strong>Azure Policy<\/strong> for governance at scale<\/li>\n<li><strong>Privileged Identity Management processes<\/strong> (tooling depends on org)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud engineer \/ cloud administrator<\/li>\n<li>Network engineer (cloud networking)<\/li>\n<li>Platform engineer<\/li>\n<li>SRE \/ operations engineer<\/li>\n<li>Security engineer (cloud security posture and access controls)<\/li>\n<li>DevOps engineer (infrastructure and operational access patterns)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (Azure)<\/h3>\n\n\n\n<p>Azure certifications change frequently; verify the latest role-based certifications on Microsoft Learn. Commonly relevant tracks include:\n&#8211; Azure Fundamentals\n&#8211; Azure Administrator\n&#8211; Azure Network Engineer\n&#8211; Azure Security Engineer<\/p>\n\n\n\n<p>Start here and confirm current certification lineup:\nhttps:\/\/learn.microsoft.com\/credentials\/certifications\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Build a \u201cprivate VM access\u201d reference environment:<\/li>\n<li>VNet + Bastion + private VMs + policy to deny public IPs<\/li>\n<li>Implement subnet segmentation:<\/li>\n<li>Allow SSH\/RDP only from Bastion subnet to VM subnet<\/li>\n<li>Add monitoring:<\/li>\n<li>Route Bastion diagnostics to Log Analytics and build alerts for unusual access patterns<\/li>\n<li>Automate with IaC:<\/li>\n<li>Recreate the lab with Bicep or Terraform (verify official examples and best practices)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Azure Bastion<\/strong>: Managed service providing secure RDP\/SSH to VMs without public IPs.<\/li>\n<li><strong>VNet (Virtual Network)<\/strong>: Private network boundary in Azure.<\/li>\n<li><strong>Subnet<\/strong>: Segment of a VNet\u2019s address space used to isolate resources.<\/li>\n<li><strong><code>AzureBastionSubnet<\/code><\/strong>: Required dedicated subnet name where Azure Bastion is deployed.<\/li>\n<li><strong>RDP (Remote Desktop Protocol)<\/strong>: Protocol used to access Windows machines interactively.<\/li>\n<li><strong>SSH (Secure Shell)<\/strong>: Encrypted protocol for remote shell access, common on Linux.<\/li>\n<li><strong>NSG (Network Security Group)<\/strong>: Stateful L3\/L4 firewall rules for subnets and NICs in Azure.<\/li>\n<li><strong>Public IP<\/strong>: Internet-routable IP address resource in Azure.<\/li>\n<li><strong>Private IP<\/strong>: IP address reachable only within private networks (VNet\/peering\/VPN\/ER).<\/li>\n<li><strong>RBAC (Role-Based Access Control)<\/strong>: Azure authorization system for resource access.<\/li>\n<li><strong>Diagnostic settings<\/strong>: Azure Monitor configuration to send logs\/metrics to destinations like Log Analytics.<\/li>\n<li><strong>Log Analytics Workspace<\/strong>: Azure Monitor log store used for query and analysis.<\/li>\n<li><strong>Hub-and-spoke<\/strong>: Network topology with a central hub VNet connected to spoke VNets.<\/li>\n<li><strong>Jump box \/ jump host<\/strong>: A server used as an intermediate hop for administrative access.<\/li>\n<li><strong>Attack surface<\/strong>: The set of entry points an attacker can target.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>Azure Bastion is an Azure Networking service that provides secure RDP\/SSH access to Azure VMs over encrypted connections without requiring public IP addresses on those VMs. It matters because it reduces public exposure of management ports, simplifies secure operations access, and integrates with Azure RBAC and monitoring.<\/p>\n\n\n\n<p>Architecturally, Bastion sits in a dedicated <code>AzureBastionSubnet<\/code> inside a VNet and proxies admin sessions to private VM IPs. Cost-wise, it\u2019s a paid service with SKU-based pricing and usage dimensions (hourly plus data-related charges); the biggest cost pitfalls are leaving it running everywhere and over-logging.<\/p>\n\n\n\n<p>Security-wise, Bastion is strongest when paired with least-privilege RBAC, policies that prevent VM public IPs, subnet segmentation that only allows RDP\/SSH from the Bastion subnet, and centralized logging.<\/p>\n\n\n\n<p>Use Azure Bastion when you want a standardized, managed, secure admin access path to private VMs without deploying and maintaining jump box VMs. Next, deepen your skills by learning hub-and-spoke network design, Azure Policy governance, and Azure Monitor\/SIEM integration\u2014and validate all SKU-specific capabilities against the latest official docs: https:\/\/learn.microsoft.com\/azure\/bastion\/<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Networking<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[40,50,10],"tags":[],"class_list":["post-488","post","type-post","status-publish","format-standard","hentry","category-azure","category-networking","category-security"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/488","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=488"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/488\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=488"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=488"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=488"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}