You're a great admin... on-prem. Now, become a great admin in the cloud and prove it by passing the Microsoft Certified: Azure Administrator Associate exam!
Azure Bastion is a fully managed platform-as-a-service that provides secure RDP and SSH access to virtual machines directly through the Azure portal. This setup ensures that your target virtual machines do not need public IP addresses, which protects them from internet-based attacks. To begin, you must deploy the service within a virtual network that contains a dedicated subnet named AzureBastionSubnet. This subnet must use a prefix size of at least /26 to ensure there are enough IP addresses to support the host and any future scaling. Administrators can deploy this service using the portal, PowerShell, or the Azure CLI.
Deploying the Bastion host involves a clear sequence of operations to establish a secure boundary. First, you configure the target virtual network with its standard subnets and the specialized Bastion subnet. Next, you must provision a public IP address using the Standard SKU, which the Bastion host uses to receive incoming management traffic on port 443. Finally, you associate the public IP address and the designated subnet when creating the Bastion host resource.
To control traffic moving in and out of the Bastion subnet, you must attach a specialized Network Security Group (NSG). The inbound rules must allow HTTPS traffic over port 443 from the public internet to enable administrator connections. Meanwhile, the outbound rules must permit traffic to reach your target virtual machines on ports 3389 for RDP and 22 for SSH. Restricting these outbound rules to the private IP addresses of your target virtual machines prevents unauthorized network traversal.
A system architecture diagram showing how Azure Bastion sits in a dedicated subnet within a virtual network, receiving external management traffic over TLS on port 443 and forwarding RDP and SSH traffic to private virtual machines.
When connection errors occur, administrators should use the Connection Troubleshoot tool within Network Watcher. This utility tests the direct TCP connection between the Bastion host and the target virtual machine to pinpoint where the traffic is being blocked. For example, if a user experiences a black screen upon connecting, the root cause is often client-side firewalls blocking WebSockets or a missing NSG rule. Additionally, virtual machines that rely on Just-In-Time (JIT) VM access require specific role assignments so that the Bastion service can successfully request temporary network openings.
Maintaining reliable access requires strict adherence to NSG rule configurations on the Bastion subnet. For inbound traffic, the NSG must allow port 443 from the GatewayManager service tag and ports 8080 and 5701 for internal data plane communication between host instances. For outbound traffic, the NSG must allow communication to the target VMs on ports 3389 and 22, as well as port 443 to the AzureCloud service tag to send diagnostic logs. Missing any of these rules can disrupt service updates, block connectivity, or cause monitoring failures.
To support high-traffic environments, you can scale the Bastion deployment to handle more concurrent sessions. Utilizing the Standard SKU or higher allows you to configure host scaling, which increases the number of instances up to a maximum of 50. A single instance typically supports up to 20 concurrent RDP sessions or 40 SSH sessions. To leverage this capability, the initial subnet must be sized at /26 or larger, as smaller subnets lack the IP space required to host these additional instances.
Authentication issues are often caused by using incorrect formatting or unsupported security keys. When connecting to domain-joined Windows virtual machines, users must input their credentials using the User Principal Name format, such as username@domain.com, instead of older formats. For Linux connections, the private SSH keys must use RSA, DSA, or OPENSSH formats to be accepted. If you modify the DNS settings of the virtual network, you must perform a full redeployment of the Bastion host so it can recognize the changes and support Kerberos authentication.
Monitoring who is accessing your workloads is critical for maintaining a secure environment. Enabling BastionAuditLogs records every administrative session, capturing user identities and connection durations for audit purposes. Within the portal, administrators can use the active sessions page to force-disconnect hung or unauthorized sessions immediately. For environments with strict compliance regulations, the Premium SKU offers session recording, which captures all graphical activity during RDP and SSH connections and stores it in an Azure storage account.
Azure Bastion operates as a fully managed service that protects your workloads by keeping virtual machines entirely isolated from the public internet. By forcing all management traffic through TLS-encrypted sessions, you eliminate the risk of port scanning on your private servers. To further strengthen this boundary, you can integrate Azure Firewall into your virtual network topology to inspect and filter traffic before it reaches Bastion. The NSG on the Bastion subnet must also allow outbound traffic over port 80 to the internet, which the service relies on for certificate validation and session management.
Securing access to the Bastion host itself depends on a combination of Microsoft Entra ID and Azure RBAC. Users who need to connect to target virtual machines must be assigned the Reader role on the virtual machine, the network interface card, the virtual network, and the Bastion resource itself. To enforce the principle of least privilege, you can implement Privileged Identity Management (PIM) to grant these administrative roles on a temporary, just-in-time basis. Additionally, SSH keys should be managed securely within Azure Key Vault, with access permissions restricted to simple retrieval operations to prevent credential theft.
To optimize costs and streamline operations in large environments, you can deploy a single Bastion host in a hub virtual network and connect to virtual machines residing in peered spoke virtual networks. For environments demanding maximum isolation, the Premium SKU supports a private-only deployment that completely eliminates the public IP address. This configuration allows secure connections exclusively through private endpoints, making it ideal for networks linked via ExpressRoute or a VPN. To guarantee high availability, you can deploy Bastion across multiple availability zones, which protects management access from single-datacenter failures.
Continuous monitoring ensures that your remote access methods remain compliant with corporate security policies. You should enable NSG flow logs along with Azure Monitor, Traffic Analytics, and Microsoft Defender for Cloud to detect anomalous traffic patterns and security threats. Session recordings generated by Premium SKU deployments must be stored in secure Azure storage accounts governed by strict retention and access lifecycle policies. Regularly auditing these logs and active configurations ensures that no unauthorized changes compromise your secure management boundary.
Prepare and test your skills
Prepare and test your skills
Azure Bastion requires a dedicated subnet named AzureBastionSubnet with a prefix size of at least /26 to ensure there are enough IP addresses to support the host and any future scaling.
For inbound traffic, the NSG must allow port 443 from the GatewayManager service tag and ports 8080 and 5701 for internal data plane communication. For outbound traffic, the NSG must allow communication to target VMs on ports 3389 and 22, as well as port 443 to the AzureCloud service tag to send diagnostic logs.
Using the Standard SKU or higher allows host scaling up to a maximum of 50 instances. A single instance typically supports up to 20 concurrent RDP sessions or 40 SSH sessions, but this requires the initial subnet to be sized at /26 or larger.
Users must be assigned the Reader role on the virtual machine, the network interface card, the virtual network, and the Bastion resource itself to connect to target virtual machines.
StudyCerts
StudyCerts