6.2 Azure Bastion & Remote Management Security

5.2 Azure Bastion & Remote Management Security

Exposing RDP (TCP 3389) or SSH (TCP 22) management ports directly to the public internet creates severe security vulnerabilities, subjecting virtual machines to relentless brute-force attacks, credential stuffing, and zero-day protocol exploits. Azure Bastion eliminates public administrative exposure by providing a fully managed, agentless Platform as a Service (PaaS) jump-box service that delivers seamless RDP and SSH access to virtual machines directly inside the Azure Portal or via native clients over encrypted TLS/HTTPS (Port 443).

---

Azure Bastion Architecture & Zero-Public-IP Access

Azure Bastion is provisioned inside your Virtual Network and operates as an HTML5 web proxy. When an administrator initiates a session, Azure Bastion establishes an outbound HTTPS connection on port 443 to the administrator's web browser or native client CLI, converts the session stream, and initiates an internal RDP or SSH connection to the target VM's private IP address.

+---------------------------------------------------------------------------------------------------------+
|                                    AZURE BASTION ARCHITECTURE                                           |
|                                                                                                         |
|  +---------------------------+  HTTPS (Port 443)   +-------------------------------------------------+  |
|  | Admin Client Browser /    |====================>| Virtual Network (10.2.0.0/16)                   |  |
|  | Native RDP/SSH Client     |  TLS Encrypted      |                                                 |  |
|  +---------------------------+                     |  +-------------------------------------------+  |  |
|                                                    |  | AzureBastionSubnet (10.2.0.0/26)         |  |  |
|                                                    |  |  +-------------------------------------+  |  |  |
|                                                    |  |  | Azure Bastion Managed Host Instances|  |  |  |
|                                                    |  |  +-------------------------------------+  |  |  |
|                                                    |  +-------------------------------------------+  |  |
|                                                    |                        |                        |  |
|                                                    |                        | Internal RDP (3389)    |  |
|                                                    |                        | Internal SSH (22)      |  |
|                                                    |                        v                        |  |
|                                                    |  +-------------------------------------------+  |  |
|                                                    |  | Workload Subnet (10.2.1.0/24)            |  |  |
|                                                    |  |  +-------------------------------------+  |  |  |
|                                                    |  |  | Target Workload VM (10.2.1.4)      |  |  |  |
|                                                    |  |  | (No Public IP Address Assigned)     |  |  |  |
|                                                    |  |  +-------------------------------------+  |  |  |
|                                                    |  +-------------------------------------------+  |  |
|                                                    +-------------------------------------------------+  |
+---------------------------------------------------------------------------------------------------------+

Key Security Advantages of Azure Bastion

• No Public IPs Required on Target VMs: Target virtual machines do not require a public IP address, NSG public exposure rules, or complex agent software.
• Protection Against Port Scanning: Management ports (22/3389) are never exposed to the public internet, completely neutralizing automated internet port scanners.
• Zero Agent Overhead: Operates seamlessly on standard Windows and Linux OS distributions without installing custom management agents or certificates inside the guest OS.
• Centralized OS Patching: Microsoft maintains, patches, and secures the underlying Bastion proxy platform automatically.

---

Azure Bastion SKU Tiering & Capability Matrix

Azure Bastion provides four distinct SKU tiers catering to environments ranging from lightweight developer setups to highly regulated, enterprise-grade deployments.

Comparative Feature Matrix across Bastion SKUs

---

AzureBastionSubnet Sizing & Network Security Group (NSG) Requirements

To deploy Azure Bastion (Basic, Standard, or Premium SKUs), a dedicated subnet named AzureBastionSubnet must be created within the target Virtual Network.

Subnet Sizing Requirements

• Exact Naming Requirement: The subnet name must be strictly specified as AzureBastionSubnet. Any deviation results in deployment failure.
• Minimum Prefix Size: Must be /26 or larger (/26, /25, /24). A /26 prefix provides 64 IP addresses, accommodating scale-out instances, control plane components, and high-availability upgrades.

Mandatory Network Security Group (NSG) Rules

If an NSG is attached to AzureBastionSubnet, it MUST include specific inbound and outbound rules to prevent control plane disruption:

+-----------------------------------------------------------------------------------------------+
|                              MANDATORY BASTION NSG RULE MATRIX                                |
+-----------+-----------------------+---------------+---------------+---------------------------+
| Direction | Rule Name             | Source        | Destination   | Port / Protocol           |
+-----------+-----------------------+---------------+---------------+---------------------------+
| Inbound   | AllowHttpsInbound     | Internet      | *             | 443 (TCP)                 |
| Inbound   | AllowGatewayManager   | GatewayManager| *             | 443 (TCP)                 |
| Inbound   | AllowControlPlane     | BastionHost   | BastionHost   | 8080, 5701 (TCP)          |
| Inbound   | AllowLbInbound        | AzureLoadBal  | *             | 443 (TCP)                 |
+-----------+-----------------------+---------------+---------------+---------------------------+
| Outbound  | AllowRdpSshOutbound   | *             | VirtualNetwork| 3389 (RDP), 22 (SSH) (TCP)|
| Outbound  | AllowAzureCloudOut    | *             | AzureCloud    | 443 (TCP)                 |
| Outbound  | AllowControlPlaneOut  | BastionHost   | BastionHost   | 8080, 5701 (TCP)          |
| Outbound  | AllowGetSessionInformation | *        | Internet      | 80 (TCP)                  |
+-----------+-----------------------+---------------+---------------+---------------------------+

Exam Caution: Blocking GatewayManager inbound on port 443 or blocking outbound AzureCloud traffic breaks Microsoft control plane connectivity, causing Azure Bastion to enter an unmanageable Failed state.

---

Native Client Integration & CLI Tunneling

With the Azure Bastion Standard or Premium SKU, administrators can bypass the Azure Portal web client and connect using native desktop applications—such as Windows Remote Desktop Connection (mstsc.exe), OpenSSH, or PuTTY—via Azure CLI tunneling.

Native Client Connection Commands

# 1. SSH connection to a Linux VM via Azure CLI Bastion tunnel
az network bastion ssh \
  --name MyBastionHost \
  --resource-group rg-secure-networking \
  --target-resource-id /subscriptions/<SubID>/resourceGroups/rg-workloads/providers/Microsoft.Compute/virtualMachines/LinuxVM \
  --auth-type ssh-key \
  --username azureuser \
  --ssh-key ~/.ssh/id_rsa

# 2. RDP connection to a Windows VM using native mstsc.exe launcher
az network bastion rdp \
  --name MyBastionHost \
  --resource-group rg-secure-networking \
  --target-resource-id /subscriptions/<SubID>/resourceGroups/rg-workloads/providers/Microsoft.Compute/virtualMachines/WinVM

# 3. Create a local custom tunnel port for third-party tools (e.g., database clients or PuTTY)
az network bastion tunnel \
  --name MyBastionHost \
  --resource-group rg-secure-networking \
  --target-resource-id /subscriptions/<SubID>/resourceGroups/rg-workloads/providers/Microsoft.Compute/virtualMachines/DBVM \
  --resource-port 1433 \
  --port 50022

---

Advanced Security Features: IP Connections & Session Management

IP-Based Connections Across Peered Networks

Azure Bastion Standard and Premium SKUs support IP-based connections. This capability allows a single centralized Azure Bastion host residing in a Hub Virtual Network to establish RDP/SSH sessions to virtual machines or on-premises servers located in spoke VNets or peered corporate networks by directly referencing their target IP address, eliminating the need to deploy multiple Bastion instances across subnets.

Session Monitoring & Disconnect Controls

Azure Bastion provides built-in administrative auditing and session controls within the Azure Portal under Bastion -> Sessions:

1. Real-time Session Tracking: Displays active remote user sessions, including target VM resource IDs, user principal names, start timestamps, protocol types, and source IP addresses.
2. Forced Administrative Disconnect: Security engineers can select any active session and click Delete / Disconnect to terminate an unauthorized or suspicious user session immediately.
3. Session Recording (Premium SKU): Automatically captures graphical RDP and SSH terminal sessions, storing encrypted video recordings in an Azure Storage Account container for audit compliance and forensic investigation.