What is Azure Bastion?
Azure Bastion is a fully managed PaaS service that enables secure RDP and SSH access to virtual machines directly through the Azure Portal. VMs no longer need public IP addresses, as the connection occurs via TLS in the browser.
The service is deployed in the virtual network and protects VMs from brute-force attacks and port scanning.
Core Features
- Browser-based RDP and SSH access without client installation
- No public IP addresses required on VMs
- TLS-encrypted connections (port 443)
- Integration with Azure Active Directory for authentication
- Native client support for local RDP/SSH clients
- Shareable links for time-limited access
Typical Use Cases
Zero Trust Network: Elimination of public IP addresses on VMs. Administrators access exclusively through the Azure Portal, without VPN or jump hosts.
Compliance requirements: All access is authenticated and logged through Azure AD. Auditors receive full traceability of all remote sessions.
Temporary access: With Shareable Links, external service providers can receive time-limited access to specific VMs without needing Azure permissions.
Benefits
- No management of jump hosts or VPN infrastructure
- Reduced attack surface by eliminating public IPs
- Centralized logging of all access
- Works over standard HTTPS without firewall adjustments
Frequently Asked Questions
What does Azure Bastion cost?
Azure Bastion is billed hourly. The Basic tier costs approximately $0.19/hour, the Standard tier approximately $0.35/hour. Additional costs apply for outbound data transfers.
What is the difference between Basic and Standard tier?
The Standard tier offers additional features such as Native Client Support, Shareable Links, scaling to multiple instances, and support for Kerberos authentication.
Can I use existing RDP/SSH clients?
Yes, with the Standard tier you can use local RDP and SSH clients via Azure CLI. The connection is routed through the Bastion tunnel.
Does Azure Bastion work with peered VNets?
Yes, Azure Bastion can reach VMs in peered virtual networks. The peering connection must be configured bidirectionally.
Integration with innFactory
As a Microsoft Solutions Partner, innFactory supports you with Azure Bastion: network architecture, Zero Trust implementation, and access control.
