Azure Bastion solves a common problem when running servers in Microsoft Azure: administration requires RDP or SSH to be reachable, but open ports on the internet are a target for attacks. Bastion is deployed in the virtual network and connects administrators to the virtual machines over TLS on port 443. The machines need neither a public IP address nor an agent or special client software.
How does Azure Bastion work?
Bastion is a platform-as-a-service offering that Microsoft fully manages. The Basic, Standard and Premium variants require a dedicated subnet named AzureBastionSubnet in the virtual network, sized /26 or larger, plus a static public IP address of the Standard SKU. The connection to the servers then runs over their private IP addresses. Through peering, a Bastion host can also reach servers in connected networks.
Connections are possible in three ways:
- In the browser: through the Azure portal with an HTML5 client, in all SKUs.
- With the local client: with the RDP or SSH program on your own computer, from Standard upwards. Sign-in with Microsoft Entra ID is also possible.
- Through a shareable link: people without access to the Azure portal connect through a link, from Standard upwards.
The SKUs at a glance
- Developer: free, on shared infrastructure, for development and testing. Connects one VM at a time and is only available in selected regions.
- Basic: dedicated deployment with fixed capacity for production use.
- Standard: adds the local client, shareable links, connection by IP address, custom ports, file transfer and scalable capacity.
- Premium: adds session recording and a deployment with a private IP address only.
Costs consist of an hourly price per SKU and outbound data transfer. Billing starts at deployment, regardless of usage.
Bastion, VPN and ExpressRoute
Bastion does not replace site connectivity. Anyone using applications in Azure from the corporate network still needs an Azure VPN Gateway or Azure ExpressRoute. Bastion only covers administrative access to individual servers. This fits well with an approach based on zero trust: instead of a whole network, only the session to the target server is opened.
What companies should keep in mind
- Use Azure roles to restrict access to Bastion to the people who actually manage servers.
- Secure sign-ins with Conditional Access and multi-factor authentication. Which policies are possible depends on the licenses, see Entra ID P1 and P2.
- Consider session recording for service providers and particularly critical servers, in the sense of privileged access management.
- After the switch, remove RDP and SSH rules on firewalls and public IP addresses of the VMs.
Azure Bastion with TOMORIS
TOMORIS plans access to Azure servers as part of its cloud expertise, together with network, identities and operations.