Azure Bastion

In the Ultra Transcenders books

AZ-305AZ-104AZ-700SC-500SC-900AZ-802ALZ

Each book explains Azure Bastion in context, with comparison tables and the common traps.

Terms in this definition

• RDP

  Remote Desktop Protocol, which Windows uses for remote sessions over port 3389; through Azure Bastion it travels inside TLS on 443 instead.

• SSH

  Protocol for remote sessions, chiefly on Linux, using TCP port 22.

• OVER

  Gives a T-SQL window function its window: PARTITION BY, ORDER BY and, if wanted, a ROWS or RANGE frame. Rankings and running totals can then be worked out while every row is kept.

• TLS

  Transport Layer Security, the encryption protocol for traffic like HTTPS and Bastion sessions over port 443. On a storage account, minimumTlsVersion fixes the oldest accepted version without opening any network access.

• Virtual machines

  Infrastructure-as-a-service compute giving complete control of the operating system, making it a fit for lift-and-shift moves and for software relying on OS-level pieces like COM.

• Just-in-time VM access

  Defender for Servers capability that keeps management ports closed through deny rules in an NSG or Azure Firewall, then opens them temporarily for the requester's IP, by default for at most 3 hours. VMs lacking either control aren't supported.

Related terms

• AzureBastionSubnet

  Name that Azure Bastion's dedicated subnet must have. Since 2 November 2021 it must be /26 or larger for all SKUs needing one (every SKU but Developer); previously /27 was allowed.

• Bastion Developer SKU

  Free tier of Azure Bastion, hosted on shared infrastructure, which connects to a single VM at a time, works without an AzureBastionSubnet and can't reach peered VNets. Every paid tier (Basic, Standard, Premium) needs its own AzureBastionSubnet sized /26 or larger.

• mstsc

  The Remote Desktop Connection client built into Windows. By itself it cannot connect to a VM lacking a public IP, but az network bastion rdp launches it via Azure Bastion.

• Native client support

  Azure Bastion option, on Standard tier and above, that allows az network bastion rdp and ssh to connect using a client installed locally, mstsc for example.