Connect to Virtual Machines (Bastion)¶

If your platform has the hub Azure Bastion enabled (create_bastion_host in the connectivity layer), you reach the VMs in your spoke through the central Bastion host. You don't give your VMs public IP addresses.

Check with your platform team

Whether Bastion exists, its name, resource group and subscription are set per platform. The examples use placeholders. Ask your platform team for the values.

What you need¶

Need	Details
Rights on the Bastion host	Your platform team gives your team the right to use the hub Bastion. A platform can do this through a dedicated group that contains the team groups of all spokes (Dedicated group manager). In the Azure portal, search for Bastion. If you don't see it, ask your platform team.
Rights on the VM	Valid credentials, set up by the VM owner (your team): a user name and password, or an SSH key.
The VM's private IP address or resource ID	In the portal on the VM page.

Because Bastion is central, the Connect button on the VM page doesn't work. Connect from the Bastion resource or with the Azure CLI.

If your platform runs a Bastion host per region, use the one in the same region as your VM. It gives the lowest latency and the shortest network path. Ask your platform team for the name and link of each host.

Sign in with Entra ID

Signing in to a VM with Entra ID identities needs the Bastion native client and a platform that supports it. Many platforms start with user name and password or SSH keys only. Ask your platform team what applies to you. With the optional Managed VM module, Entra ID sign-in is available: add --auth-type "AAD" to az network bastion ssh and az network bastion rdp. See Managed virtual machines.

Connect with the portal¶

Open the Bastion host in the portal and choose Connect.
Enter the private IP address of the VM, choose the protocol (SSH for Linux, RDP for Windows) and the credentials.
Select Connect. A new browser tab opens with your session. Your browser may block the pop-up.

Connect with the Azure CLI (native client)¶

Replace the placeholders. These commands work from Windows, macOS and Linux with the Azure CLI installed.

az login
az account set --subscription "<bastion subscription id>"

Linux VM over SSH, with an SSH key, by private IP:

az network bastion ssh --name "<bastion name>" --resource-group "<bastion resource group>" \
  --target-ip-address "<vm private ip>" --auth-type "ssh-key" --username "<user>" --ssh-key "<key file>"

Linux VM over SSH, with a password, by resource ID:

az network bastion ssh --name "<bastion name>" --resource-group "<bastion resource group>" \
  --target-resource-id "<vm resource id>" --auth-type "password" --username "<user>"

Windows VM over RDP on Windows:

az network bastion rdp --name "<bastion name>" --resource-group "<bastion resource group>" \
  --target-resource-id "<vm resource id>"

Windows VM over RDP from macOS or Linux (tunnel):

az network bastion tunnel --name "<bastion name>" --resource-group "<bastion resource group>" \
  --target-resource-id "<vm resource id>" --resource-port 3389 --port 3389
# then connect your RDP client to localhost:3389

For --target-ip-address use the VM's private IP instead of --target-resource-id.

The portal can't sign in with Entra ID identities, and az network bastion rdp is meant for Windows clients (see above). On macOS, open a tunnel with the Azure CLI and connect with the Windows App (Microsoft's Remote Desktop client). The steps below are an example for a Windows VM that is joined to Entra ID. Check them with your platform team.

Open the tunnel. Use a local port above 1024 if the default RDP port is busy:

az network bastion tunnel --name "<bastion name>" --resource-group "<bastion resource group>" \
  --target-resource-id "<vm resource id>" --resource-port 3389 --port 22222

Leave this terminal open for as long as you need the session.

In the Windows App, create a connection (or import an .rdp file) with your own account as the user name and <vm name>:22222 as the address.
Add a line to /etc/hosts so that the VM name points at your own machine (sudo is needed):
```
127.0.0.1 <vm name>
```
In the RDP connection, switch on the settings for Entra ID sign-in. In an .rdp file these are enablerdsaadauth:i:1 and targetisaadjoined:i:1.
Connect. The Windows App asks for your Entra ID credentials.

Remove the hosts entry when you no longer need it.

Reach other private resources¶

Bastion is for VMs. For private endpoints of PaaS services (storage, databases, Key Vault) from your own laptop, the usual route is the corporate network or VPN, and not Bastion. Whether you need a firewall rule for this depends on how your organisation connects laptops to Azure, so ask your platform team before you request one.

If it doesn't work¶

Symptom	Likely cause
You don't see the Bastion host	You don't have rights on it. Ask your platform team.
Connection times out	A network rule or NSG on the VM blocks SSH/RDP from the Bastion subnet. Check the NSG of the spoke subnet (change request). The hub firewall may also need to allow SSH (22) or RDP (3389) from the Bastion to your subnet. Ask your platform team.
Login fails	Wrong credentials, or the platform doesn't support Entra ID login for VMs.