What Azure Bastion Does and When You Actually Need One
A managed way to reach your VMs without opening RDP or SSH to the internet
By Shehryar Hassan, Microsoft 365 & Azure Consultant
If you've ever had to open RDP or SSH to a VM just to run a quick check, you know the trade-off. You get in fast, but now that port sits open to the internet until you remember to close it again. Azure Bastion exists to get rid of that trade-off.
What it actually does
Bastion is a managed service that sits inside your virtual network and gives you RDP or SSH access to VMs straight from the Azure portal, through your browser. There's no public IP needed on the VM, no inbound rule for port 3389 or 22, and no VPN client to install first. You open the VM's page, click Connect, and a session opens in a new tab.
Under the hood it's really a jump box that Microsoft runs for you. You deploy it once into a dedicated subnet in your VNet, named exactly AzureBastionSubnet, sized at least a /26. After that, every VM in that network, and any peered network, can connect through it.
When it's worth setting up
If you manage a handful of VMs and you're the only one connecting to them, a locked-down network security group rule or a VPN gateway might already cover you. Bastion starts earning its keep once more than a couple of admins connect regularly, or once someone asks why RDP is open to the whole internet on a production box. It also helps when people connect from different networks, home Wi-Fi, a coffee shop, a client site, since there's nothing to VPN into first, just a browser.
The catch
Bastion is billed hourly whether anyone uses it or not, plus a small charge for data processed. Leave it running in a dev subscription nobody touches on weekends and the cost adds up for nothing. If budget is tight, look at the Developer SKU. It's free, it covers basic RDP or SSH to one VM at a time, and it's missing extras like native client support and session recording, but for a small environment that's often enough.
For anything customer facing, or any subscription that gets audited, I'd set this up from the start now rather than wait for someone to ask why a VM still has a public IP attached.
Get new posts by email
One note when there is something worth reading. No spam, unsubscribe anytime.
Related articles
Azure Front Door, What It Does and When You'd Actually Use One
Azure Front Door routes visitors to the closest healthy copy of your site and can add a free SSL certificate along the way. Here's when it actually earns its keep.
What an Azure Managed Identity Actually Does (and Why You Want One)
Azure managed identities let an App Service, Function App, or VM authenticate to other Azure resources without you ever having to store or rotate a secret.
What Azure Application Insights Actually Tracks (and Why You'd Turn It On)
Application Insights sounds like another thing to configure, but once you turn it on for a web app, you stop guessing why it's slow or crashing.