Azure Bastion for secure VM access - Step-by-Step Execution

Process Flow - Azure Bastion for secure VM access

User wants VM access

↓

Connect to Azure Portal

↓

Select VM

↓

Use Azure Bastion

↓

Azure Bastion creates secure tunnel

↓

User accesses VM securely

↓

Session ends

User connects to VM through Azure Portal using Azure Bastion, which creates a secure tunnel without exposing VM to public internet.

Execution Sample

Azure

az network bastion create \
  --resource-group MyResourceGroup \
  --location MyLocation \
  --name MyBastionHost \
  --public-ip-address MyBastionIP \
  --vnet-name MyVnet

This command creates an Azure Bastion host in a virtual network to enable secure VM access.

Process Table

Step	Action	Resource Created/Used	Result/State
1	Create public IP for Bastion	Public IP: MyBastionIP	Public IP allocated and ready
2	Create Bastion host in VNet	Bastion Host: MyBastionHost	Bastion host deployed and linked to VNet
3	User selects VM in portal	VM: TargetVM	VM selected for connection
4	User clicks 'Connect' via Bastion	Bastion Host	Secure tunnel established
5	User accesses VM via browser RDP/SSH	VM: TargetVM	Secure session active
6	User ends session	Bastion Host	Tunnel closed, VM remains secure

💡 User ends session, secure tunnel closes, VM remains protected without public IP exposure

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 4	After Step 5	Final
Public IP	None	Allocated	Allocated	Allocated	Allocated	Allocated
Bastion Host	None	None	Created	Created	Created	Created
VM Connection	Disconnected	Disconnected	Disconnected	Connected	Connected	Disconnected
Secure Tunnel	Closed	Closed	Closed	Open	Open	Closed

Key Moments - 3 Insights

Why can't I connect directly to the VM without Azure Bastion?

The VM does not have a public IP and is protected inside a virtual network. Azure Bastion creates a secure tunnel to access it without exposing it to the internet, as shown in execution_table steps 4 and 5.

What happens if the public IP for Bastion is not created first?

Azure Bastion requires a public IP to accept connections. Without it (see variable_tracker Public IP at Start and After Step 1), the Bastion host cannot be created or used.

Does Azure Bastion expose the VM's RDP or SSH ports to the internet?

No. Azure Bastion tunnels the connection securely inside Azure's network, so the VM's ports remain closed to the public internet, as seen in execution_table step 5.

Visual Quiz - 3 Questions

Look at the execution_table, at which step is the secure tunnel established?

A Step 3

B Step 5

C Step 4

D Step 2

💡 Hint

Check the 'Result/State' column for when the tunnel opens.

According to variable_tracker, what is the state of the VM connection after Step 2?

A Connected

B Disconnected

C Connecting

D Unknown

💡 Hint

Look at the 'VM Connection' row under 'After Step 2'.

If the public IP is not allocated, what will happen to the Bastion host creation?

A Bastion host creation will fail

B Bastion host will be created successfully

C Bastion host will be created but unusable

D Public IP is not required for Bastion

💡 Hint

Refer to key_moments about the necessity of public IP for Bastion.

Concept Snapshot

Azure Bastion enables secure VM access without public IPs.
Create a public IP, then deploy Bastion host in the VNet.
Use Azure Portal to connect via Bastion, which tunnels RDP/SSH securely.
No direct exposure of VM ports to the internet.
Session ends close the tunnel, keeping VM protected.

Full Transcript

Azure Bastion is a service that lets you securely connect to virtual machines without exposing them to the public internet. First, you create a public IP address for the Bastion host. Then, you deploy the Bastion host inside your virtual network. When you want to access a VM, you select it in the Azure Portal and connect through Bastion. This creates a secure tunnel that lets you use RDP or SSH in your browser. The VM itself does not need a public IP and remains protected. When you finish, the tunnel closes, and the VM stays secure. This process avoids opening VM ports to the internet and uses Azure's secure infrastructure.

Practice

1. What is the main purpose of Azure Bastion when accessing virtual machines (VMs)?

easy

A. To backup VM data to Azure storage

B. To create public IP addresses for all VMs automatically

C. To replace virtual networks with a simpler network

D. To provide secure, browser-based access to VMs without exposing public IP addresses

Solution

1. Step 1: Understand Azure Bastion's role

   Azure Bastion allows users to connect to VMs securely through a browser without needing a public IP on the VM.

2. Step 2: Compare options with this role

   Only To provide secure, browser-based access to VMs without exposing public IP addresses describes this secure, browser-based access without public IP exposure.

3. Final Answer:

   To provide secure, browser-based access to VMs without exposing public IP addresses -> Option D

4. Quick Check:

   Azure Bastion = Secure browser access without public IP [OK]

Hint: Azure Bastion hides VM public IPs for secure browser access [OK]

Common Mistakes:

• Thinking Azure Bastion creates public IPs for VMs
• Confusing Azure Bastion with backup services
• Assuming it replaces virtual networks

2. Which subnet name is required to deploy Azure Bastion correctly?

easy

A. AzureBastionSubnet

B. PublicSubnet

C. GatewaySubnet

D. BastionSubnet

Solution

1. Step 1: Recall Azure Bastion subnet naming requirement

   Azure Bastion requires a dedicated subnet named exactly 'AzureBastionSubnet' for deployment.

2. Step 2: Match options with the required name

   Only AzureBastionSubnet matches the exact required subnet name.

3. Final Answer:

   AzureBastionSubnet -> Option A

4. Quick Check:

   Subnet name for Bastion = AzureBastionSubnet [OK]

Hint: Azure Bastion subnet must be named AzureBastionSubnet exactly [OK]

Common Mistakes:

• Using 'BastionSubnet' instead of 'AzureBastionSubnet'
• Confusing with 'GatewaySubnet' used for VPN gateways
• Naming subnet 'PublicSubnet' incorrectly

3. Given this Azure CLI command snippet to create an Azure Bastion host, what will be the result?

az network bastion create --resource-group MyResourceGroup --name MyBastionHost --public-ip-address MyPublicIP --vnet-name MyVNet --subnet AzureBastionSubnet --location eastus

medium

A. Fails because the subnet AzureBastionSubnet is missing in MyVNet

B. Creates a VM named MyBastionHost instead of a Bastion host

C. Creates an Azure Bastion host named MyBastionHost in MyResourceGroup using MyPublicIP and MyVNet

D. Creates a public IP named MyBastionHost

Solution

1. Step 1: Check prerequisites for Azure Bastion creation

   Azure Bastion requires a subnet named 'AzureBastionSubnet' in the specified virtual network before creation.

2. Step 2: Analyze command and subnet presence

   If the subnet AzureBastionSubnet exists in MyVNet, the command will successfully create the Bastion host.

3. Final Answer:

   Creates an Azure Bastion host named MyBastionHost in MyResourceGroup using MyPublicIP and MyVNet -> Option C

4. Quick Check:

   Azure Bastion host created if subnet exists [OK]

Hint: Azure Bastion needs AzureBastionSubnet before creation [OK]

Common Mistakes:

• Assuming the command creates the subnet automatically
• Confusing Bastion host with VM creation
• Thinking public IP is created with Bastion host name

4. You deployed Azure Bastion but cannot connect to your VM through the Azure portal. What is the most likely cause?

medium

A. The AzureBastionSubnet is smaller than /27

B. The VM is in a different virtual network than the Bastion host

C. The VM has a public IP address assigned

D. The Bastion host is deployed in the same subnet as the VM

Solution

1. Step 1: Understand Bastion host and VM network relationship

   Azure Bastion must be deployed in the same virtual network as the VM to allow secure access.

2. Step 2: Analyze options for connectivity issues

   If the VM is in a different virtual network, Bastion cannot connect to it, causing failure.

3. Final Answer:

   The VM is in a different virtual network than the Bastion host -> Option B

4. Quick Check:

   VM and Bastion must share the same VNet [OK]

Hint: Bastion and VM must be in the same virtual network [OK]

Common Mistakes:

• Assigning public IP to VM does not block Bastion access
• Thinking subnet size smaller than /27 causes failure
• Deploying Bastion in VM subnet is not allowed

5. You want to secure access to multiple VMs in different subnets within the same virtual network using Azure Bastion. Which configuration is required?

hard

A. Deploy one Azure Bastion host in a dedicated AzureBastionSubnet in the virtual network; no public IPs needed on VMs

B. Deploy an Azure Bastion host in each subnet where VMs are located

C. Assign public IPs to all VMs and connect directly without Bastion

D. Deploy Azure Bastion in a separate virtual network and peer it with VM networks

Solution

1. Step 1: Understand Azure Bastion scope within a virtual network

   One Azure Bastion host per virtual network can provide secure access to all VMs in any subnet within that network.

2. Step 2: Evaluate options for multi-subnet VM access

   Deploy one Azure Bastion host in a dedicated AzureBastionSubnet in the virtual network; no public IPs needed on VMs correctly states deploying one Bastion host in the required subnet with no public IPs on VMs.

3. Final Answer:

   Deploy one Azure Bastion host in a dedicated AzureBastionSubnet in the virtual network; no public IPs needed on VMs -> Option A

4. Quick Check:

   One Bastion per VNet secures all subnets [OK]

Hint: One Bastion host per VNet secures all subnets [OK]

Common Mistakes:

• Deploying Bastion in every subnet wastes resources
• Assigning public IPs defeats Bastion's purpose
• Trying to peer Bastion in separate VNet for access