Say goodbye to public IPs and complex setups and enjoy a streamlined experience that focuses on keeping your workloads protected while letting you focus on what matters most—your work.

Introduction to Azure Bastion

Azure Bastion makes managing remote access to your Azure virtual machines (VMs) both secure and seamless. As a fully managed platform-as-a-service (PaaS), it eliminates the need to expose your VMs to the public Internet or rely on a VPN, reducing risks and simplifying the process.

Whether you’re working from the office, home, or on the go, Azure Bastion ensures that you can connect to your VMs directly through the Azure portal without additional configuration or worry about network vulnerabilities.

With Azure Bastion, you get an all-in-one solution designed for simplicity and security. It supports RDP and SSH protocols, so you can access your VMs using your preferred tools without compromising on safety. Say goodbye to public IPs and complex setups and enjoy a streamlined experience that focuses on keeping your workloads protected while letting you focus on what matters most—your work.

Azure Bastion uses SSL and TLS encryption protocols to secure the connections between the remote user and the VM. It also supports multi-factor authentication (MFA) using Azure Active Directory (Azure AD), adding an extra layer of security to the remote access process.

Azure Bastion can be easily deployed using the Azure Portal or Resource Manager templates. Once deployed, it provides a web-based interface that can be used to connect to VMs using RDP or SSH, eliminating the need for any client software or VPN connections.

Some benefits of using Azure Bastion include enhanced security, simplified remote access, improved compliance, and reduced infrastructure complexity. It can also help organizations meet compliance requirements such as SOC 2, HIPAA, and PCI DSS by providing a more secure way to access VMs.

Azure Bastion Use Cases

Azure Bastion is an ideal solution for remote access to virtual machines (VMs) running in Azure. You get the perfect balance of convenience and security, ensuring your VMs remain protected while being easily accessible.

Here are some common scenarios where Azure Bastion truly shines:

Remote administration

Azure Bastion provides secure remote access to VMs running in Azure, allowing administrators to remotely manage and configure their infrastructure without requiring a VPN connection.

Remote development

Developers can use Azure Bastion to access development environments securely and code repositories hosted in Azure, enabling them to work from anywhere without compromising security.

Remote troubleshooting

Azure Bastion provides secure access to VMs for troubleshooting and diagnosing issues without a VPN connection.

Compliance requirements

Azure Bastion can help meet compliance requirements by providing a secure and auditable way to access VMs without needing an open VPN connection.

Contractor and vendor access

Azure Bastion can be used to provide secure remote access to VMs for contractors and vendors without requiring them to connect to the organization’s VPN, providing an extra layer of security.

Setup

Here are the most important steps to configure Azure Bastion, broken down into a simple and approachable guide. Let’s make sure you feel confident about setting this up. Following these steps will help you get it up and running smoothly:

Step I – Create a virtual network

Azure Bastion requires a virtual network to be deployed. If you don’t have a virtual network already, create one in the Azure portal.

Step II – Create a subnet

Once you have created a virtual network, create a subnet within it. This subnet will be used to deploy Azure Bastion. The Azure Bastion subnet must meet the following requirements:

  • It must be a dedicated subnet within a virtual network and cannot be shared with other resources.
  • It must be named “AzureBastionSubnet” with a minimum address space of /27 (for example, 10.0.0.0/27).
  • It must be associated with a network security group (NSG) that is configured to allow traffic from the Internet to the Azure Bastion service.
  • It must be located in the same region as the virtual machines that will be accessed using Azure Bastion.
  • It must not be used for any other purpose or contain any other resources.

Step III – Deploy Azure Bastion

In the Azure portal, navigate to the virtual machine you want to access using Azure Bastion. In the “Connect” blade, select “Bastion” as the type of remote connection, and then click on “Create new” to create an Azure Bastion instance. Follow the prompts to specify the network and subnet, and click “Review + create” to create the Azure Bastion instance.

Step IV – Configure network security groups

To ensure your virtual machine is accessible from Azure Bastion, you must configure network security groups (NSGs) to allow traffic from the Bastion subnet to the virtual machine. You can create inbound security rules allowing RDP or SSH traffic from the Azure Bastion subnet.

Step V – Connect to the virtual machine

Once you have created Azure Bastion and configured NSGs, you can connect to your virtual machine using the Azure portal.

Navigate to the virtual machine and click “Connect”, then select “Bastion” as the type of remote connection. This will open a web-based remote desktop session in your browser, allowing you to access your virtual machine securely.

Azure Bastion connect to Linux VM
Azure Bastion connect to Windows VM

Azure Bastion – Limitations

Here are a few things that some people may not know about Azure Bastion, a few limitations to keep in mind. These limitations highlight the importance of understanding your needs when considering Azure Bastion for your setup.

Only supports RDP and SSH: Azure Bastion only supports Remote Desktop Protocol (RDP) and Secure Shell (SSH) connections to virtual machines (VMs) in Azure. Other remote access protocols are not supported.

Limited to specific regions: Azure Bastion is currently available in a limited number of regions, and not all regions support all the features of Azure Bastion.

No public IP address required: Unlike traditional remote access solutions, Azure Bastion does not require a public IP address for the VMs it connects to. Instead, it uses a private IP address assigned to the VM and connects securely over the Azure network.

Integration with Azure AD: Azure Bastion integrates with Azure Active Directory (AD) for identity and access management, enabling you to control access to Azure Bastion using Azure AD groups and policies.

Limited to certain VM SKUs: Azure Bastion is currently only supported on specific virtual machine SKUs, including those that support RDP and SSH connections.

Bandwidth limitations: Azure Bastion is subject to network bandwidth limitations, so it may not be suitable for high-bandwidth applications or large file transfers.

Limited to certain network configurations: Azure Bastion requires a specific configuration, including a dedicated subnet and particular network security group (NSG) rules.

Despite these limitations, Azure Bastion remains an excellent choice for those seeking a simple, secure, and seamless way to manage remote access to their VMs. By understanding its constraints, you can better decide how to integrate it into your overall cloud strategy.

Best Practices

Here are some examples of good practices when using Azure Bastion. By following these recommendations, you can enhance the security and performance of Azure Bastion and ensure that it is deployed and used in a way that aligns with your organization’s security policies and requirements.

Enable MFA: Use Azure AD to enable multi-factor authentication (MFA) for users connecting to Azure Bastion to add an extra layer of security.

Use Azure Policy: Use Azure Policy to ensure that only authorized users have access to Azure Bastion and that it is only deployed in approved virtual networks.

Use private endpoints: Use Azure Private Endpoints to restrict access to Azure Bastion to only authorized resources on your virtual network.

Use Azure Monitor: Use Azure Monitor to track the usage and performance of Azure Bastion to identify issues and optimize performance.

Use session timeouts: Configure session timeouts for Azure Bastion to automatically disconnect idle sessions after a set period to reduce the risk of unauthorized access.

Keep Azure Bastion up to date: Ensure that Azure Bastion is always up to date with the latest security patches and updates to reduce the risk of vulnerabilities.

Use custom DNS settings: Configure custom DNS settings for Azure Bastion to simplify access and ensure your DNS resolution requirements are met.

References

If you’re looking to dive deeper into this topic, check out the references below for more insights and details. These resources will help you explore the subject further and enhance your understanding

  1. Microsoft Azure Bastion documentation
  2. Exam Ref AZ-104 Microsoft Azure Administrator, Harshul Patel
  3. Secure Access to Azure VMs with Azure Bastion, Neil Mackenzie
  4. Azure Bastion Blog
Tamara Petrović

Tamara is a system administrator devoted to maintaining the smooth operation of computer systems and networks. She is constantly learning and staying up to date with the latest advancements in technology. In her spare time, she takes care of her furry friends and practices yoga to keep her balanced.