Azure Bastion troubleshooting

Most Bastion problems are network rules (NSGs on the Bastion subnet or the VM subnet), the wrong SKU for what you're trying to do, or a credential format the VM doesn't accept. Work through the symptom that matches.

1. Deployment fails or the subnet is rejected

The subnet must be named exactly AzureBastionSubnet, be /26 or larger, sit in the same VNet and resource group as the Bastion, and contain nothing else.
The public IP must be Standard SKU, Static (not needed for Developer or Premium private-only).
Dedicated deployments take about 10 minutes; Developer deploys in seconds but only in supported regions.

2. "Network security group … doesn't have necessary rules for Azure Bastion Subnet"

If you attach an NSG to AzureBastionSubnet, Microsoft requires all of these rules — omit one and the NSG create/update fails, or Bastion stops receiving platform updates:

Rule	Direction	Source → Destination	Ports
AllowHttpsInbound	Inbound	Internet → *	443/TCP
AllowGatewayManagerInbound	Inbound	GatewayManager → *	443/TCP
AllowAzureLoadBalancerInbound	Inbound	AzureLoadBalancer → *	443/TCP
AllowBastionHostCommunication	Inbound	VirtualNetwork → VirtualNetwork	8080, 5701
AllowSshRdpOutbound	Outbound	* → VirtualNetwork	22, 3389
AllowAzureCloudOutbound	Outbound	* → AzureCloud	443/TCP
AllowBastionCommunication	Outbound	VirtualNetwork → VirtualNetwork	8080, 5701
AllowHttpOutbound	Outbound	* → Internet	80

On the target VM subnet, allow inbound 3389/22 from the AzureBastionSubnet range (or your custom port on Standard+). Without it, "Bastion can't reach your VMs even when it's correctly configured".

3. Unable to connect to the VM

Microsoft's first step: open the Bastion resource → Help → Connection Troubleshoot (Network Watcher) and test a TCP connection from the Bastion to the VM's IP and port. Then check:

The VM is running and listening on 3389/22 (or the custom port you specified).
The VM subnet NSG allows the port from AzureBastionSubnet.
No UDR/forced tunnelling sends Bastion→VM traffic through a firewall that drops it.
Just-in-time (JIT) access is enabled on the VM: the connecting user also needs Microsoft.Security/locations/jitNetworkAccessPolicies/read and …/write.
For native client: SKU is Standard/Premium and Native Client Support is ticked; the user has Reader on VM, NIC and Bastion.

4. Black screen in the portal

Either your browser can't reach Bastion (a client-side firewall blocking WebSockets) or Bastion can't reach the VM — "most cases include an NSG applied either to AzureBastionSubnet, or on your target VM subnet that's blocking the RDP/SSH traffic". Allow WebSockets on the client side and re-check the NSGs above.

5. "Your session has expired"

Expected if you opened the Bastion URL directly from another tab or browser session — it must be launched from the Azure portal. Sign in to the portal and start the session again.

6. SSH key errors

SSH Private key must start with -----BEGIN RSA/DSA/OPENSSH PRIVATE KEY-----: the portal accepts RSA, DSA and OpenSSH private keys whose public half is on the VM. Generate one with:

ssh-keygen -t rsa -b 4096 -C "[email protected]"

Native client: a key stored in Azure Key Vault isn't supported — download it to a local file first.

Bastion supports domain sign-in with username/password only, and the username must be in UPN format ([email protected]), not DOMAIN\user. Domain-joined and hybrid-joined VMs are supported; Microsoft Entra joined-only VMs are not for this path.

The identity needs Virtual Machine Administrator Login or Virtual Machine User Login on the VM, and the VM must have Entra sign-in enabled.
RDP with Entra credentials only works from Windows 10/11 PCs that are Entra registered/joined/hybrid-joined to the same directory as the VM; use --enable-mfa on supported Windows versions.
Non-admin RDP users must be in the VM's Remote Desktop Users group.

9. File transfer doesn't work

Upload/download is only available through the native client (RDP, or SSH via the tunnel command) on Standard+ — not in the portal or via PowerShell.

10. Native-client command fails outright

az extension add --name bastion (and --name ssh for key-pair SSH); CLI ≥ 2.32.
Native client connections aren't supported from Cloud Shell.
az network bastion tunnel needs a local port ≥ 1024 without root.

Common questions

Do I have to attach an NSG to AzureBastionSubnet?

No — it's optional. But if you do, all eight rules above are mandatory or the platform rejects the NSG.

Bastion connects to one VM but not another in the same VNet — why?

Almost always the second VM's subnet NSG (or its OS firewall) doesn't allow 3389/22 from the AzureBastionSubnet range, or the VM isn't listening on that port.

Can I get more detail than "unable to connect"?

Use Connection Troubleshoot on the Bastion resource, and Bastion's diagnostic logs (Monitoring → Diagnostic settings) for per-session records.