Azure Bastion Fundamentals

Azure Bastion
  • The Bastion host is deployed in the virtual network that contains the AzureBastionSubnet subnet.
  • The Bastion is provisioned per virtual network where VM/s reside(which are to be connected).
  • The user connects to the Azure portal using any HTML5 browser.
  • The user selects the virtual machine to connect to.
  • With a single click, the RDP/SSH session opens in the browser.
  • No public IP is required on the Azure VM. The Azure Bastion host uses a Public IP.
Azure Bastion works across peered vNets — A Central Hub vNet can contain single common Bastion Host
  • Reader role on the virtual machine.
  • Reader role on the NIC with private IP of the virtual machine.
  • Reader role on the Azure Bastion resource.
  • Reader role on the virtual network (for peered virtual networks).
Azure Bastion SKUs

Instances and host scaling

  • An instance is an optimized Azure VM that is created when you configure Azure Bastion.
  • It’s fully managed by Azure and runs all of the processes needed for Azure Bastion.
  • An instance is also referred to as a scale unit.
  • You connect to client VMs via an Azure Bastion instance.
  • When you configure Azure Bastion using the Basic SKU, two instances are created. If you use the Standard SKU, you can specify the number of instances. This is called host scaling.
  • Each instance can support 25 concurrent RDP connections and 50 concurrent SSH connections for medium workloads
  • It may be noted that 1 host instance does not equal 1 user session.
  • Instances are created in the AzureBastionSubnet. To allow for host scaling, the AzureBastionSubnet should be /26 or larger. Using a smaller subnet limits the number of instances you can create.



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Aditya Garg

Aditya Garg


Cloud Consultant |Zumba Enthusiast | Seaside Lover | 2XAzure, 1XAWS, 1XCCNP, 1XCCNA