What is Azure Bastion?

Azure Bastion is "a fully managed PaaS service that provides secure and seamless RDP/SSH connectivity to your virtual machines directly over TLS from the Azure portal, or via the native SSH or RDP client already installed on your local computer". It's deployed into your virtual network and reaches VMs by private IP — so the VMs "don't need a public IP address, agent, or special client software".

1. The problem it replaces

Without Bastion, reaching an Azure VM means either giving it a public IP and opening 3389/22 to the internet (and getting port-scanned all day), or running your own jump box VM with the same exposure plus patching duties. Bastion is Microsoft's managed jump box: you connect to it over HTTPS/443, and it opens the RDP or SSH session to the VM inside the VNet on your behalf.

2. How a connection flows

Your browser or RDP/SSH client ──(TLS 443)──► Azure Bastion ──(RDP 3389 / SSH 22, private IP)──► your VM

Browser-based: open the VM in the Azure portal → Connect → Bastion; an HTML5 client renders the session in the browser. Available on every SKU.
Native client: az network bastion rdp / ssh / tunnel open your own mstsc, ssh, Remmina or PuTTY through Bastion. Standard and Premium SKUs only.
Shareable links: a URL that lets someone connect to a specific VM without portal access (Standard+).

Authentication to the VM is whatever the VM accepts — local username/password, SSH key pair, Kerberos for domain-joined VMs, or Microsoft Entra ID sign-in for Entra-enabled VMs via the native client.

3. Key benefits, as Microsoft states them

Secure connectivity over TLS on port 443.
Protection from external threats — VMs aren't exposed for port scanning.
Scalability — host scaling, shareable links, IP-based connection (Standard+).
Reduced management overhead — deploy once; serve peered VNets too (Basic+).
Compliance and audit — session recording on the Premium SKU.

4. SKUs in one paragraph

Developer is free, uses shared infrastructure, one VM at a time, portal only, no peering, select regions — for dev/test. Basic is a dedicated, fixed-capacity host (2 instances). Standard adds native client support, custom ports, IP-based connection, shareable links, file transfer and host scaling (2–50 instances). Premium adds session recording and private-only deployment (no public IP). Full matrix in Azure Bastion SKUs explained.

5. What it needs from your network

Dedicated SKUs (Basic, Standard, Premium) need a subnet named exactly AzureBastionSubnet, /26 or larger, in the VM's VNet, plus a Standard, static public IP (Premium private-only excepted). If you attach an NSG to that subnet it must carry Microsoft's full rule set (443 in from Internet/GatewayManager/AzureLoadBalancer, 8080/5701 within the VNet, 22/3389 out to the VNet, 443 out to AzureCloud, 80 out to Internet) — see Bastion troubleshooting.

6. What it costs

Pricing is hourly per SKU plus outbound data transfer (first 5 GB/month free), and billing "starts from the moment Bastion is deployed, regardless of usage". Developer is free; Standard and Premium include two instances with extra instances billed separately. Exact figures vary by region — see the pricing page.

7. How Reach uses it

TYO Reach's Remote Targets for Azure use Bastion's native-client tunnelling: a team member signs in with their Microsoft work account, clicks the VM in the Reach tray, and RDP/SSH opens on a local port — no az CLI, no portal.

Common questions

Does the VM need an agent or a public IP?

No. Bastion reaches the VM over its private IP from inside the VNet; Microsoft's own words are "no public IP address, agent, or special client software".

Can I use my own RDP or SSH client?

Yes, on the Standard or Premium SKU with Native Client Support enabled — via az network bastion rdp, ssh or tunnel. Basic and Developer are portal-only.

Does Bastion work across peered virtual networks?

Basic, Standard and Premium can serve VMs in peered VNets, so one Bastion can cover a hub-and-spoke topology. Developer cannot.

Is Bastion the same as a VPN?

No. Bastion brokers individual RDP/SSH sessions; it doesn't put your laptop on the network. For the comparison with a self-managed jump box, see Bastion vs a jump box.