Azure Bastion provides a secure way to administer virtual machines (VMs) running in Azure without exposing them to the internet or requiring complex network configurations. It acts as a "managed jump box" to enable secure remote desktop and SSH connections to VMs using TLS and port 443 without having to open inbound ports or assign public IP addresses. Bastion supports just-in-time access and peering between virtual networks in preview.

1. Secure your VM access with
Azure Bastion

2. The VM Administrative
Access Problem Space

3. You need to manage your VMs running in Azure…

4. …and you need to prevent breaches

5. Common VM
administrative access
methods

6. Hybrid cloud

7. VMs with public IP addresses (PIPs)

8. NAT through Azure Load Balancer

9. Jump box

10. Azure Bastion

11. Azure Bastion – Managed jump box
Azure Portal
Remote Protocol
(RDP, SSH)
TLS
Internet
Port 443
AzureBastionSubnet
TLS
Virtual Network
Azure VM
Azure VM
Azure VM
Target VM Subnet(s)
Azure Bastion
Private IP
Port: 3389, 22
“Gateway Manager”
Bastion controller

12. JIT VM Access

13. JIT VM Access

14. Bastion Support for VNet Peering(Preview)

15. Azure Bastion roadmap
currently in preview