Azure Bastion for secure VM access - Deep Dive

Overview - Azure Bastion for secure VM access

What is it?

Azure Bastion is a service that lets you securely connect to virtual machines (VMs) in Azure without exposing them to the internet. It provides a safe way to access VMs using your web browser through the Azure portal. This means you do not need to open ports or manage public IP addresses on your VMs.

Why it matters

Without Azure Bastion, accessing VMs often requires opening network ports or using VPNs, which can expose your machines to attacks. Azure Bastion solves this by creating a secure, private connection that reduces the risk of hacking. This keeps your cloud environment safer and easier to manage.

Where it fits

Before learning Azure Bastion, you should understand basic Azure networking and virtual machines. After mastering Bastion, you can explore advanced network security concepts like network security groups and private endpoints.

Mental Model

Core Idea

Azure Bastion acts as a secure bridge that lets you safely reach your cloud machines without opening doors to the outside world.

Think of it like...

Imagine your VM is a house in a gated community. Azure Bastion is the guarded gatehouse that lets you in safely without leaving the main gate open for anyone else.

┌───────────────┐       ┌───────────────┐       ┌───────────────┐
│ Your Browser  │──────▶│ Azure Bastion │──────▶│ Virtual Machine│
└───────────────┘       └───────────────┘       └───────────────┘
       ▲                      ▲                        ▲
       │                      │                        │
   No direct             Secure tunnel           No public IP
   internet              through Azure            exposed
   access                portal

Build-Up - 7 Steps

1

Foundation

Understanding VM access basics

Concept: Learn how virtual machines are accessed and why direct internet access can be risky.

Virtual machines in the cloud run like computers you can control remotely. Usually, you connect to them using protocols like RDP (Windows) or SSH (Linux). To do this, VMs often have public IP addresses and open ports, which can be attacked by hackers.

Result

You understand that opening ports and public IPs expose VMs to security risks.

Knowing the risks of direct VM access helps you appreciate why safer methods like Azure Bastion are needed.

2

Foundation

Azure networking essentials

Concept: Learn about Azure Virtual Networks and how VMs connect within them.

Azure Virtual Networks (VNets) are like private neighborhoods for your VMs. VMs inside a VNet can talk to each other securely. Normally, to reach a VM from outside, you need to open a path through the network, which can be unsafe.

Result

You see that VNets isolate VMs but external access needs careful handling.

Understanding VNets sets the stage for why Azure Bastion’s secure access inside the network is valuable.

3

Intermediate

How Azure Bastion works

🤔Before reading on: Do you think Azure Bastion requires installing software on your VM or opening ports? Commit to your answer.

Concept: Azure Bastion provides secure VM access without installing agents or opening inbound ports on VMs.

Azure Bastion is a managed service deployed inside your VNet. It creates a secure, encrypted connection from your browser through the Azure portal to your VM. It uses the VNet’s private IPs, so your VM never needs a public IP or open ports.

Result

You can connect to VMs securely via the Azure portal without exposing them to the internet.

Knowing that Bastion works without changing VM settings or exposing ports highlights its security advantage.

4

Intermediate

Setting up Azure Bastion

🤔Before reading on: Do you think Azure Bastion can be used across multiple VNets or only one? Commit to your answer.

Concept: Learn the steps to deploy Azure Bastion in a VNet and connect to VMs.

To use Azure Bastion, you create a Bastion host in your VNet. This host has a subnet called AzureBastionSubnet with a specific IP range. Once deployed, you can select a VM in the portal and click 'Connect' via Bastion. No extra client software is needed.

Result

You have a working Bastion host that enables secure browser-based VM access.

Understanding the deployment requirements prevents common setup errors and ensures secure access.

5

Intermediate

Security benefits of Azure Bastion

🤔Before reading on: Does Azure Bastion eliminate the need for VPNs or just reduce their use? Commit to your answer.

Concept: Azure Bastion improves security by removing public IPs and open ports, reducing attack surface.

By using Bastion, VMs don’t need public IPs or exposed RDP/SSH ports. This stops common attacks like port scanning or brute force. It also simplifies compliance by centralizing access control through Azure Active Directory and role-based access.

Result

Your VMs are safer and easier to manage securely.

Knowing how Bastion reduces attack vectors helps prioritize it in secure cloud designs.

6

Advanced

Scaling and cost considerations

🤔Before reading on: Do you think Azure Bastion scales automatically or requires manual scaling? Commit to your answer.

Concept: Understand how Bastion scales with demand and its pricing model.

Azure Bastion automatically scales to handle multiple simultaneous connections. Pricing is based on hours of use and data transfer. Planning usage helps control costs. You can also deploy Bastion in multiple VNets or regions for high availability.

Result

You can design cost-effective, scalable Bastion deployments.

Knowing scaling and cost helps balance security needs with budget constraints.

7

Expert

Advanced networking and Bastion integration

🤔Before reading on: Can Azure Bastion connect to VMs in peered VNets without extra setup? Commit to your answer.

Concept: Explore how Bastion works with complex network setups like VNet peering and private endpoints.

Azure Bastion supports connecting to VMs in peered VNets if network rules allow. However, it does not natively support cross-region peering or private link endpoints without additional configuration. Understanding these limits helps design secure multi-VNet architectures.

Result

You can architect secure, multi-network VM access using Bastion with proper network design.

Knowing Bastion’s network boundaries prevents security gaps in complex cloud environments.

Under the Hood

Azure Bastion runs as a managed platform service inside your VNet in a dedicated subnet. It uses a secure HTML5-based web client in the Azure portal to create an encrypted TLS tunnel directly to the VM’s private IP address. This avoids exposing RDP/SSH ports publicly. Bastion handles authentication via Azure Active Directory and enforces network security group rules to control traffic.

Why designed this way?

Azure Bastion was designed to solve the problem of securely accessing VMs without managing jump servers or VPNs. Traditional methods exposed VMs to the internet or required complex setups. Bastion’s managed, browser-based approach reduces operational overhead and attack surface, fitting modern cloud security best practices.

┌───────────────────────────────┐
│        Azure Portal            │
│  (Browser with HTML5 client)  │
└───────────────┬───────────────┘
                │ TLS Tunnel
                ▼
┌───────────────┴───────────────┐
│       Azure Bastion Host       │
│  (Managed service in subnet)   │
└───────────────┬───────────────┘
                │ Private IP
                ▼
┌───────────────┴───────────────┐
│        Virtual Machine         │
│  (No public IP, no open ports)│
└───────────────────────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does Azure Bastion require a public IP on the VM to work? Commit to yes or no.

Common Belief: Azure Bastion needs the VM to have a public IP address to connect.

Reality: Azure Bastion connects to VMs using their private IP addresses inside the VNet, so no public IP is needed.

Why it matters: Believing this leads to unnecessary exposure of VMs to the internet, increasing security risks.

Quick: Can Azure Bastion replace VPNs completely in all scenarios? Commit to yes or no.

Common Belief: Azure Bastion fully replaces VPNs for all types of network access.

Reality: Azure Bastion only provides secure RDP/SSH access to VMs, not full network connectivity like VPNs do.

Why it matters: Misunderstanding this can cause gaps in network security or access planning.

Quick: Does Azure Bastion require installing software agents on VMs? Commit to yes or no.

Common Belief: You must install special software on each VM to use Azure Bastion.

Reality: Azure Bastion works without any agents on VMs; it uses standard RDP/SSH protocols over secure tunnels.

Why it matters: Thinking otherwise complicates deployment and discourages use of Bastion.

Quick: Can Azure Bastion connect to VMs across different Azure regions by default? Commit to yes or no.

Common Belief: Azure Bastion can connect to any VM in any region without extra setup.

Reality: Azure Bastion is deployed per VNet and region; cross-region VM access requires additional configuration or multiple Bastion hosts.

Why it matters: Assuming universal access leads to failed connections and insecure workarounds.

Expert Zone

1

Azure Bastion’s HTML5 client means no extra software is needed on user devices, simplifying access management.

2

Bastion’s deployment requires a dedicated subnet named AzureBastionSubnet with a minimum /27 IP range, which is often overlooked but critical.

3

While Bastion secures RDP/SSH, it does not encrypt data inside the VM; combining it with disk encryption and endpoint security is essential.

When NOT to use

Azure Bastion is not suitable when full network access is required, such as accessing multiple services or databases inside a VNet. In such cases, VPNs or ExpressRoute are better. Also, for very high-scale or cross-region needs, multiple Bastion hosts or alternative jump servers may be needed.

Production Patterns

In production, Bastion is often combined with Azure Active Directory for role-based access control, integrated with network security groups to restrict traffic, and deployed in multiple VNets for segmented environments. Teams use Bastion to avoid managing jump boxes and reduce attack surfaces.

Connections

Zero Trust Security Model

Azure Bastion embodies Zero Trust by never trusting direct VM access and always verifying through a secure gateway.

Understanding Bastion helps grasp how Zero Trust principles apply in cloud infrastructure to minimize exposure.

VPN (Virtual Private Network)

Both provide secure remote access but VPN offers broader network connectivity while Bastion focuses on VM access.

Knowing the difference clarifies when to use Bastion versus VPN for cloud access.

Physical Security Checkpoints

Like a security guard controlling entry to a building, Bastion controls access to VMs without opening doors to everyone.

This cross-domain link shows how security principles in physical spaces inspire cloud security designs.

Common Pitfalls

#1 Trying to deploy Azure Bastion without the required subnet.

Wrong approach:

Deploy Bastion host in any subnet without creating AzureBastionSubnet.

Correct approach:

Create a dedicated subnet named AzureBastionSubnet with at least /27 IP range before deploying Bastion.

Root cause:

Not knowing Bastion requires a special subnet causes deployment failures.

#2 Opening RDP/SSH ports on VMs despite using Bastion.

Wrong approach:

Allow inbound port 3389 or 22 on VM network security groups.

Correct approach:

Close all inbound RDP/SSH ports on VMs and rely solely on Bastion for access.

Root cause:

Misunderstanding Bastion’s purpose leads to unnecessary exposure.

#3 Assuming Bastion provides full network access beyond VM connections.

Wrong approach:

Using Bastion to access databases or services inside the VNet directly.

Correct approach:

Use Bastion only for VM access; use VPN or private endpoints for other resources.

Root cause:

Confusing Bastion’s scope with full network connectivity.

Key Takeaways

Azure Bastion provides secure, browser-based access to VMs without exposing them to the internet.

It works by deploying a managed host inside your virtual network that tunnels connections privately to VMs.

Using Bastion eliminates the need for public IPs and open ports on VMs, greatly reducing security risks.

Proper setup requires a dedicated subnet and understanding of Azure networking concepts.

While Bastion secures VM access, it does not replace VPNs for full network connectivity or cross-region access without extra configuration.

Practice

1. What is the main purpose of Azure Bastion when accessing virtual machines (VMs)?

easy

A. To backup VM data to Azure storage

B. To create public IP addresses for all VMs automatically

C. To replace virtual networks with a simpler network

D. To provide secure, browser-based access to VMs without exposing public IP addresses

Solution

1. Step 1: Understand Azure Bastion's role

   Azure Bastion allows users to connect to VMs securely through a browser without needing a public IP on the VM.

2. Step 2: Compare options with this role

   Only To provide secure, browser-based access to VMs without exposing public IP addresses describes this secure, browser-based access without public IP exposure.

3. Final Answer:

   To provide secure, browser-based access to VMs without exposing public IP addresses -> Option D

4. Quick Check:

   Azure Bastion = Secure browser access without public IP [OK]

Hint: Azure Bastion hides VM public IPs for secure browser access [OK]

Common Mistakes:

• Thinking Azure Bastion creates public IPs for VMs
• Confusing Azure Bastion with backup services
• Assuming it replaces virtual networks

2. Which subnet name is required to deploy Azure Bastion correctly?

easy

A. AzureBastionSubnet

B. PublicSubnet

C. GatewaySubnet

D. BastionSubnet

Solution

1. Step 1: Recall Azure Bastion subnet naming requirement

   Azure Bastion requires a dedicated subnet named exactly 'AzureBastionSubnet' for deployment.

2. Step 2: Match options with the required name

   Only AzureBastionSubnet matches the exact required subnet name.

3. Final Answer:

   AzureBastionSubnet -> Option A

4. Quick Check:

   Subnet name for Bastion = AzureBastionSubnet [OK]

Hint: Azure Bastion subnet must be named AzureBastionSubnet exactly [OK]

Common Mistakes:

• Using 'BastionSubnet' instead of 'AzureBastionSubnet'
• Confusing with 'GatewaySubnet' used for VPN gateways
• Naming subnet 'PublicSubnet' incorrectly

3. Given this Azure CLI command snippet to create an Azure Bastion host, what will be the result?

az network bastion create --resource-group MyResourceGroup --name MyBastionHost --public-ip-address MyPublicIP --vnet-name MyVNet --subnet AzureBastionSubnet --location eastus

medium

A. Fails because the subnet AzureBastionSubnet is missing in MyVNet

B. Creates a VM named MyBastionHost instead of a Bastion host

C. Creates an Azure Bastion host named MyBastionHost in MyResourceGroup using MyPublicIP and MyVNet

D. Creates a public IP named MyBastionHost

Solution

1. Step 1: Check prerequisites for Azure Bastion creation

   Azure Bastion requires a subnet named 'AzureBastionSubnet' in the specified virtual network before creation.

2. Step 2: Analyze command and subnet presence

   If the subnet AzureBastionSubnet exists in MyVNet, the command will successfully create the Bastion host.

3. Final Answer:

   Creates an Azure Bastion host named MyBastionHost in MyResourceGroup using MyPublicIP and MyVNet -> Option C

4. Quick Check:

   Azure Bastion host created if subnet exists [OK]

Hint: Azure Bastion needs AzureBastionSubnet before creation [OK]

Common Mistakes:

• Assuming the command creates the subnet automatically
• Confusing Bastion host with VM creation
• Thinking public IP is created with Bastion host name

4. You deployed Azure Bastion but cannot connect to your VM through the Azure portal. What is the most likely cause?

medium

A. The AzureBastionSubnet is smaller than /27

B. The VM is in a different virtual network than the Bastion host

C. The VM has a public IP address assigned

D. The Bastion host is deployed in the same subnet as the VM

Solution

1. Step 1: Understand Bastion host and VM network relationship

   Azure Bastion must be deployed in the same virtual network as the VM to allow secure access.

2. Step 2: Analyze options for connectivity issues

   If the VM is in a different virtual network, Bastion cannot connect to it, causing failure.

3. Final Answer:

   The VM is in a different virtual network than the Bastion host -> Option B

4. Quick Check:

   VM and Bastion must share the same VNet [OK]

Hint: Bastion and VM must be in the same virtual network [OK]

Common Mistakes:

• Assigning public IP to VM does not block Bastion access
• Thinking subnet size smaller than /27 causes failure
• Deploying Bastion in VM subnet is not allowed

5. You want to secure access to multiple VMs in different subnets within the same virtual network using Azure Bastion. Which configuration is required?

hard

A. Deploy one Azure Bastion host in a dedicated AzureBastionSubnet in the virtual network; no public IPs needed on VMs

B. Deploy an Azure Bastion host in each subnet where VMs are located

C. Assign public IPs to all VMs and connect directly without Bastion

D. Deploy Azure Bastion in a separate virtual network and peer it with VM networks

Solution

1. Step 1: Understand Azure Bastion scope within a virtual network

   One Azure Bastion host per virtual network can provide secure access to all VMs in any subnet within that network.

2. Step 2: Evaluate options for multi-subnet VM access

   Deploy one Azure Bastion host in a dedicated AzureBastionSubnet in the virtual network; no public IPs needed on VMs correctly states deploying one Bastion host in the required subnet with no public IPs on VMs.

3. Final Answer:

   Deploy one Azure Bastion host in a dedicated AzureBastionSubnet in the virtual network; no public IPs needed on VMs -> Option A

4. Quick Check:

   One Bastion per VNet secures all subnets [OK]

Hint: One Bastion host per VNet secures all subnets [OK]

Common Mistakes:

• Deploying Bastion in every subnet wastes resources
• Assigning public IPs defeats Bastion's purpose
• Trying to peer Bastion in separate VNet for access