Azure Bastion vs a jump box VM
A jump box is a VM you run yourself with a public IP and RDP/SSH open, which you hop through to reach the rest of the network. Azure Bastion is Microsoft's managed version of that VM: no public IP on your workloads, no OS to patch, TLS on 443 in front, Azure RBAC deciding who may connect. Here's how they actually compare.
1. Side by side
| Self-managed jump box | Azure Bastion | |
|---|---|---|
| Public IP with 3389/22 open | Yes — it is the exposed surface | No; 443 only, on the Bastion host |
| OS patching, hardening, backups | Yours | Microsoft's ("fully managed PaaS") |
| Who may connect | Local accounts / domain / NSG IP allowlist | Azure RBAC (Reader on VM/NIC/Bastion), Entra ID, Conditional Access |
| Client | Any RDP/SSH client, double-hop | Browser (all SKUs) or native client (Standard+) |
| Audit | Whatever you log on the box | Azure Activity Log/diagnostics; session recording on Premium |
| Scale | Add VMs by hand | Basic: 2 instances fixed; Standard/Premium: 2–50 |
| Peered VNets | Route yourself | Supported on Basic+ |
| Cost model | VM + public IP + your time | Hourly per SKU from deployment + outbound data (first 5 GB/month free); Developer free |
| Port scanning exposure | Constant | None on workloads; Bastion itself is TLS-only |
2. Where Bastion wins
- Attack surface. Your VMs keep private IPs only; Microsoft's stated benefit is that they're "protected from port scanning". The only thing on the internet is a TLS endpoint on 443.
- Identity, not IPs. Access is an Azure role assignment. Remove the role and the person is out — no local accounts to clean up, no NSG allowlist to maintain as home IPs change.
- Nothing to patch. A jump box is a Windows or Linux server with all the usual CVE duty. Bastion is a service.
- Compliance. Premium adds recorded portal sessions; every connection is a logged Azure control-plane event.
- Scale and redundancy. Host scaling and availability-zone deployment on Standard+.
3. Where a jump box still fits
- Cost sensitivity at tiny scale. Bastion bills hourly from deployment regardless of use. A dev/test VNet in a supported region can use the free Developer SKU instead; otherwise a rarely-used B-series VM you deallocate may cost less than a dedicated Bastion.
- Tooling that must live inside the network — a workstation image with licensed admin tools, or agents that need a persistent foothold. Bastion brokers sessions; it doesn't run your software.
- Protocols other than RDP/SSH. Bastion's tunnel "doesn't relay web servers or hosts". A jump box can proxy anything.
- Non-Azure networks. Bastion connects to VMs in its VNet and peered VNets; on-prem or other clouds need a different answer.
If you keep a jump box, put it behind Bastion (private IP only) rather than on a public IP — you get the tooling without the exposure.
4. Cost comparison, honestly
Bastion's price is the hourly SKU rate (Standard/Premium include two instances) plus outbound data. A jump box's price is the VM SKU, disk, public IP, and — the part people forget — the hours spent patching and the risk of the open port. Microsoft's own advice for production is Premium, noting the Standard/Premium difference is "marginal". Figures vary by region; check the pricing page.
5. Migration checklist
- Deploy Bastion (Standard+ with Native Client Support if anyone uses
mstsc,sshor automation) into anAzureBastionSubnet(/26+) with a Standard static IP. - Assign Reader on VM, NIC and Bastion to the people or groups who connect; add Virtual Machine Administrator/User Login for Entra sign-in.
- Confirm target VM NSGs allow 3389/22 from the AzureBastionSubnet range.
- Test portal and native-client connections.
- Remove public IPs from the workloads, then from the jump box — or keep it private.
Common questions
Does Bastion replace a VPN as well?
No. Bastion gives session-by-session RDP/SSH to VMs; it doesn't join your laptop to the VNet. For network-level access to many services, you'd still use VPN Gateway or a zero-trust product.
Can Bastion reach VMs in other virtual networks?
Yes for peered VNets on Basic, Standard and Premium — one Bastion in a hub can serve the spokes. Developer can't.
Is the free Developer SKU good enough to retire a dev jump box?
For a single VM at a time in a supported region, yes. It has no peering, no native client and no concurrent sessions, so it won't replace a shared team jump box.