Azure Bastion native client: RDP, SSH and tunnel

With Native Client Support enabled, you can open mstsc, ssh, Remmina, PuTTY or VS Code through Bastion instead of the browser — and sign in with Microsoft Entra ID where the VM supports it. It needs the Standard or Premium SKU, Azure CLI, and a few RBAC roles.

1. Enable the feature

New deployment: on the Basics tab pick Standard or higher; on the Advanced tab tick Native Client Support. Existing Bastion: Configuration → SKU Standard or higher → tick Native Client Support → Apply.

Microsoft notes session recording "isn't available for native client", and that native client connections aren't supported from Cloud Shell.

2. Prerequisites on your machine

az extension add --name bastion     # or: az extension update --name bastion
az extension add --name ssh         # needed for key-pair SSH via az ssh
az login
az account set --subscription "<subscription ID>"

Azure CLI 2.32 or later. You'll also need the VM's Resource ID (VM → Overview → JSON View) unless you use IP-based connection.

3. Required roles and ports

Roles on the signing-in identity:

Reader on the virtual machine.
Reader on the NIC with the VM's private IP.
Reader on the Azure Bastion resource.
Virtual Machine Administrator Login or Virtual Machine User Login — only if you're signing in with Microsoft Entra ID.

Ports: the VM must accept 22 (Linux) or 3389 (Windows) — or a custom port you then pass with --resource-port. If the VM's NSG restricts sources, allow the AzureBastionSubnet range.

4. RDP to a Windows VM

az network bastion rdp --name "<BastionName>" --resource-group "<ResourceGroupName>" \
  --target-resource-id "<VMResourceId>"

You're prompted for credentials — local, or Entra — and mstsc opens. Options:

Entra authentication: add --enable-mfa (Windows 10 20H2+, Windows 11 21H2+, Windows Server 2022). Remote connection to Entra-joined VMs "is allowed only from Windows 10 or later PCs that are Microsoft Entra registered… joined, or hybrid joined to the same directory as the VM".
Custom port: --resource-port "22" — Microsoft suggests this as the workaround for SSH to a Windows VM from a Windows client.
By private IP instead of resource ID: --target-ip-address "<VMIPAddress>" (no Entra auth or custom ports on IP-based connections).

Non-admin users must be in the VM's Remote Desktop Users group.

5. SSH to a Linux VM

Entra ID (VM must have Entra login enabled):

az network bastion ssh --name "<BastionName>" --resource-group "<ResourceGroupName>" \
  --target-resource-id "<VMResourceId>" --auth-type "AAD"

SSH key pair:

az network bastion ssh --name "<BastionName>" --resource-group "<ResourceGroupName>" \
  --target-resource-id "<VMResourceId>" --auth-type "ssh-key" --username "<Username>" --ssh-key "<Filepath>"

Username and password:

az network bastion ssh --name "<BastionName>" --resource-group "<ResourceGroupName>" \
  --target-resource-id "<VMResourceId>" --auth-type "password" --username "<Username>"

Add --resource-port for a custom port. The private key must be a local file — keys stored in Azure Key Vault aren't supported with the native client.

6. Tunnel to any port, any client

az network bastion tunnel --name "<BastionName>" --resource-group "<ResourceGroupName>" \
  --target-resource-id "<VMResourceId>" --resource-port 22 --port 2222
# in another terminal:
ssh <username>@127.0.0.1 -p 2222

Use a local port ≥ 1024 unless you're root. The tunnel carries SSH or RDP only ("the bastion tunnel doesn't relay web servers or hosts"), works from Linux and macOS as well as Windows, supports file transfer over SSH, but doesn't do Entra auth or concurrent VM sessions. For VS Code Remote-SSH, Microsoft's pattern is a ~/.ssh/config host pointing at 127.0.0.1 and the tunnel port.

7. What each combination supports

Client → VM	Method	Entra auth	File transfer	Concurrent sessions	Custom port
Windows → Windows	`bastion rdp`	Yes	Yes	Yes	Yes
Windows → Linux	`bastion ssh`	Yes	No	Yes	Yes
Any → any	`bastion tunnel`	No	Yes	No	No
Linux/macOS → Linux	`bastion ssh`	Yes	No	Yes	Yes

Common questions

Which SKU do I need for `az network bastion rdp`?

Standard or Premium, with Native Client Support enabled in the Bastion configuration. Basic and Developer are portal-only.

Can I SSH from a Linux laptop to a Windows VM?

Not with az network bastion ssh directly. Open a tunnel to port 3389 (or a custom SSH port on the Windows VM) and use your own client.

RDP with Entra credentials to Entra-joined VMs is only allowed from Windows 10/11 PCs that are Entra registered, joined or hybrid joined to the same directory. From other clients, use local credentials or a tunnel.