Azure Bastion SKUs explained
Azure Bastion comes in four tiers — Developer, Basic, Standard, Premium — and the feature you most often need (using your own RDP/SSH client) only arrives at Standard. Here's the full matrix from Microsoft's documentation, and how to choose.
1. Feature comparison
| Feature | Developer | Basic | Standard | Premium |
|---|---|---|---|---|
Requires AzureBastionSubnet | No | Yes | Yes | Yes |
| Requires public IP | No | Yes | Yes | No (private-only option) |
| Dedicated host | No (shared) | Yes | Yes | Yes |
| Connect to VMs in the same VNet | Yes | Yes | Yes | Yes |
| Connect to VMs in peered VNets | No | Yes | Yes | Yes |
| Concurrent connections | No (1 VM at a time) | Yes | Yes | Yes |
| RDP to Windows / SSH to Linux | Yes | Yes | Yes | Yes |
| RDP to Linux / SSH to Windows | No | No | Yes | Yes |
| Kerberos authentication | Yes | Yes | Yes | Yes |
| Linux private keys from Key Vault (portal) | Yes | Yes | Yes | Yes |
| Portal-based connections | Yes | Yes | Yes | Yes |
| Native client (Azure CLI) | No | No | Yes | Yes |
| Custom inbound port | No | No | Yes | Yes |
| IP-based connection (IP-Connect) | No | No | Yes | Yes |
| Shareable link | No | No | Yes | Yes |
| Upload/download files (native client) | No | No | Yes | Yes |
| Disable copy/paste (web client) | No | No | Yes | Yes |
| Host scaling (2–50 instances) | No | No | Yes | Yes |
| Session recording | No | No | No | Yes |
| Private-only deployment | No | No | No | Yes |
| Hourly charge | Free | Paid | Paid | Paid |
| Outbound data transfer | Free | Paid (first 5 GB/month free) | Paid (first 5 GB free) | Paid (first 5 GB free) |
2. Capacity
| Developer | Basic | Standard | Premium | |
|---|---|---|---|---|
| Deployment | Shared resource | Dedicated | Dedicated | Dedicated |
| Instances | N/A | 2 (fixed) | 2–50 | 2–50 |
| Per-instance capacity | — | 20 RDP + 40 SSH | 20 RDP + 40 SSH | 20 RDP + 40 SSH |
| Max concurrent RDP sessions | 1 | 40 | 1,000 (at 50 instances) | 1,000 |
| Max concurrent SSH sessions | 1 | 80 | 2,000 | 2,000 |
3. Which one?
- Developer — dev/test only. Free, deploys in seconds, no
AzureBastionSubnet, but one VM at a time, no peering, portal only, and only in select regions. Microsoft warns it "isn't suitable for production workloads". - Basic — production with modest needs: dedicated two-instance host, peering, Kerberos, but portal connections only.
- Standard — the tier most teams want. Native client (
az network bastion rdp/ssh/ tunnel), custom ports, IP-based connection, shareable links, file transfer, host scaling to 50 instances. - Premium — Standard plus session recording (portal sessions; not available for native client) and private-only deployment with no public IP. Microsoft's own tip: "The cost difference between Standard and Premium is marginal. Premium SKU is the recommended choice for production deployments."
4. Upgrades and downgrades
- Upgrading to a higher SKU is supported through the portal and takes about 10 minutes; you can enable features (native client, etc.) during the upgrade.
- Developer → dedicated requires creating an
AzureBastionSubnet(/26+) and a Standard static public IP first. - Downgrading isn't supported — you delete and redeploy.
5. Pricing model
Hourly per SKU from the moment of deployment, whether or not anyone connects. Standard and Premium base pricing includes two instances; additional instances are billed per hour. Outbound data transfer is tiered, with the first 5 GB per month free. Figures are region-dependent — see the pricing page.
Common questions
Is the Developer SKU really free?
Yes — no hourly charge and no data-transfer charge. The trade-offs are one VM at a time, no VNet peering, portal-only connections and limited regions.
Do I need Premium for compliance?
Only if you need session recording (graphical recordings of portal RDP/SSH sessions stored in your storage account) or a private-only Bastion with no public IP. Otherwise Standard covers the same connectivity features.
Can I scale Basic?
No — Basic is fixed at two instances (40 RDP / 80 SSH sessions). Host scaling starts at Standard.