--- title: "Getting Started with Azure Bastion [With Step-by-Step Demo]" description: "Learn how to secure Azure VM access using Azure Bastion in this informative getting started tutorial that will demonstrate how to get going." canonical: "https://adamtheautomator.com/azure-bastion/" --- # Getting Started with Azure Bastion [With Step-by-Step Demo] > Learn how to secure Azure VM access using Azure Bastion in this informative getting started tutorial that will demonstrate how to get going. Source: https://adamtheautomator.com/azure-bastion/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Getting Started with Azure Bastion \[With Step-by-Step Demo\]](https://adamtheautomator.com/wp-content/uploads/2021/07/Getting-Started-with-Azure-Bastion-With-Step-by-Step-Demo.jpg) # Getting Started with Azure Bastion \[With Step-by-Step Demo\] [![](https://secure.gravatar.com/avatar/bbb3aa33d8c35820d2892462d21634beb25120c1b1e62e96974f69814715f6bd?s=192&d=mm&r=g)Victor Silva](https://adamtheautomator.com/author/victorsilva/)6 July 20215 min. read Categories: [Cloud](/category/cloud/) Tags:[InfoSec](/tag/infosec/)[Microsoft Azure](/tag/microsoft-azure/) Table of Contents * [Why Azure Bastion?](#h-why-azure-bastion) * [Bastion Drawbacks](#h-bastion-drawbacks) * [Prerequisites](#h-prerequisites) * [Creating the Azure Bastion Resource](#h-creating-the-azure-bastion-resource) * [Connecting to an Azure VM with Azure Bastion](#h-connecting-to-an-azure-vm-with-azure-bastion) * [Handy Shared Clipboard Functionality](#h-handy-shared-clipboard-functionality) * [Conclusion](#h-conclusion) Services like Remote Desktop Protocol (RDP) and Secure Shell (SSH) have been around forever to control [Azure virtual machines](https://azure.microsoft.com/en-us/services/virtual-machines/). But, to access them, you’ve traditionally had to either expose VM ports to the public Internet or set up a VPN. You can now use [Azure Bastion](https://azure.microsoft.com/en-us/services/azure-bastion/#:~:text=Azure%20Bastion%20is%20a%20new,need%20a%20public%20IP%20address) instead! Not a reader? Watch this related video tutorial! **_Not seeing the video? Make sure your ad blocker is disabled._** In this tutorial, you’ll learn how to protect both RDP and SSH access on your Azure VMs with Azure Bastion. Let’s get going! ## Why Azure Bastion? Before Bastion, to connect to an Azure VM with RDP or SSH, you either had to: * Connect to the machine directly exposing direct host ports. * Use an intermediary like an [RDP gateway](https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-plan-access-from-anywhere) to “tunnel” through but still exposed ports to the outside. * Connect to a “hop server” or “jump host” and make another connection to the host. * An existing [virtual network](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview) to connect the Bastion host to. These options weren’t ideal because you either had to create a security risk or go through a convoluted connection process. Bastion changed all of that. Using the managed Azure Bastion service, you can now set up a Bastion host that only exposes an HTTPS port to the outside but can transparently tunneling RDP or SSH traffic to an Azure VM. Azure Bastion is a limited and secured Azure VM with the sole purpose of remote connectivity. ## Bastion Drawbacks Before you start getting excited about Azure Bastion, you should first understand some of its drawbacks before you dedicate a lot of time to set it up. As of this writing, Azure Bastion has a few limitations you should be aware of. > _Periodically check [Azure’s Networking feedback page](https://feedback.azure.com/forums/217313-networking) to discover all issues and features Microsoft may be working on._ * **Shared Clipboard Limitations** – When using RDP, you may be used to its handy shared clipboard feature. Using the shared clipboards allows you to copy text, images, and files from your local computer to a remote host over RDP. This feature does not exist in Bastion. If you need to use RDP to transfer files from your local computer to a remote host, Azure Bastion is not for you. * **IPv4 Only** – IPv6 is currently not available. ## Prerequisites The remainder of this article will be a tutorial on setting up Azure Bastion. If you’d like to follow along with the step-by-step tutorial, be sure you have the following: * At least one Azure Windows virtual machine with a [private IP address](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-static-private-ip-arm-pportal) with [port 3389 allowed on the Windows firewall](https://www.itechtics.com/rdp-port/). You will connect to this VM through the Bastion host. * The [Azure Reader role](https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#reader) or greater assigned to the Azure VM and to the VM’s [vNic](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface). * Access to a local (or domain) account on the VM host. * An Azure resource group. If you don’t have one, the tutorial will walk you through creating one. Related:[How to Rename/Move Azure Resource Groups (GUI and CLI)](https://adamtheautomator.com/rename-azure-resource-group/) * A [public IP address](https://docs.microsoft.com/en-us/azure/virtual-network/public-ip-addresses) to assign to the Bastion host. If you don’t have one, the tutorial will walk you through creating one ## **Creating the Azure Bastion Resource** Azure Bastion is, under the covers, a locked-down VM but is not exposed as a VM but as a unique Azure resource. To get started, you must first create the Bastion resource. In this tutorial, you’re going to walk through using the Azure Portal to do so. > _You can also set up a Bastion host via PowerShell using the [Azure PowerShell modules](https://docs.microsoft.com/en-us/azure/bastion/bastion-create-host-powershell)._ 1\. First, open your favorite web browser and navigate to the [Azure Portal](https://portal.azure.com/). 2\. Click on **All Services** —> **Networking** —> **Bastions** to view the overview page where all of your configured Bastion hosts will be shown. 3\. On the **Bastions** overview page, click **Create Bastion**. ![Starting to create an Azure Bastion resource](https://adamtheautomator.com/wp-content/uploads/2021/07/Untitled-65.png) Starting to create an Azure Bastion resource 4\. Next, select your subscription and assign a resource group to create the Azure Bastion host in, or click **Create new** to create your own. ![Creating a new Resource Group for deploy Azure Bastion](https://adamtheautomator.com/wp-content/uploads/2021/07/Untitled-67.png) Creating a new Resource Group for deploy Azure Bastion 5\. Now, assign: * A name to the Bastion host of your choosing. * The region to create the Bastion host in typically choosing the location closest to you. * The virtual network to assign the Bastion host to. If you don’t have one already, click **Create new** to create a new one. > _**IMPORTANT**: If you create your own virtual network, be sure to call the associated subnet exactly “AzureBastionSubnet” with a vNet address space using a /27 subnet mask. This requirement may change as Bastion matures but for now, you must set up the subnet in this manner._ * A name for the public IP address if you’d like Azure to create one for you. You can use any name you’d like. > _You’ll need a public IP address for the initial configuration but only for initiating a connection. Once connected, you’ll use the destination VM’s private IP address to connect._ ![Creating an Azure bastion host in the Azure portal](https://adamtheautomator.com/wp-content/uploads/2021/07/Untitled-68.png) Creating an Azure bastion host in the Azure portal 6\. When you’re done assigning all of the required Bastion attributes, click on the **Review + create** button. ![Review and Create Button](https://adamtheautomator.com/wp-content/uploads/2021/07/Untitled-69.png) Review and Create Button 7\. Once validation passes, click on the **Create** button to instruct Azure to begin creating the Bastion resource. ## Connecting to an Azure VM with Azure Bastion Once you’ve deployed a Bastion resource, it’s time to actually see how you can use it to secure access to your Azure VMs. Assuming you already have an Azure VM set up as defined in the prerequisites, let’s now see how to use Azure Bastion to connect to a Windows VM via RDP. While in the Azure portal: 1\. Find the [Azure VM](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Compute%2FVirtualMachines) you’d like to connect to through Azure Bastion. 2\. Click on the **Connect** button and choose **Bastion**. ![Connect menu to select the option to connect to the VM.](https://adamtheautomator.com/wp-content/uploads/2021/07/Untitled-70.png) Connect menu to select the option to connect to the VM. 3\. On the **Connect** page, click on the **Use Bastion** button providing the username and password to a local (or if domain-joined, a domain account) to connect to the VM. ![The Use Bastion button to open the connection.](https://adamtheautomator.com/wp-content/uploads/2021/07/Untitled-71.png) The Use Bastion button to open the connection. 4\. Select **Connect** and Azure will open a new tab in your browser that will display your VM’s desktop. That’s it! You are now securely connected via RDP through your Azure Bastion host to your VM all in your browser. ### Handy Shared Clipboard Functionality If you’re directly connected to a Windows machine via RDP, you always have a shared clipboard allowing you to copy/paste back and forth. That same functionality also exists via Azure Bastion but looks a little different. While you have the Bastion console tab open, to enable the shared clipboard, click on the padlock in the URL bar and click on **Allow**, as shown below. ![Allowing shared clipboard in Azure Bastion](https://adamtheautomator.com/wp-content/uploads/2021/07/Untitled-72.png) Allowing shared clipboard in Azure Bastion Once you’ve enabled the shared clipboard, you can see below that a separate **Clipboard** box comes up, allowing you to paste in contents to make available in your VM and vice versa. ![Clipboard Box](https://adamtheautomator.com/wp-content/uploads/2021/07/Untitled-73.png) Clipboard Box ## **Conclusion** Azure Bastion is a good solution to help secure RDP or SSH access. But it may not be the right solution for every organization. Some crucial features are not yet available, such as shared clipboard images, shared files, or lack of IPv6 support. But, the security aspect may outweigh the drawbacks for you. Have you been using Azure Bastion for a while? What do you think? What are some features of Azure Bastion you’d like to see in the future? Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fazure-bastion%2F&text=Getting%20Started%20with%20Azure%20Bastion%20%5BWith%20Step-by-Step%20Demo%5D)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fazure-bastion%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fazure-bastion%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/07/featured_image-1.webp) ### [Microsoft Azure Certification Roadmap: Choose the Right Path](/azure-certification-roadmap-2/) Choose the right Microsoft Azure certification for your career goals. Compare AZ-900, AZ-104, AZ-305, AZ-400, AZ-700, DP-700, study timelines, and 2026 retirements. ![](https://adamtheautomator.com/wp-content/uploads/2021/05/How-to-RenameMove-Azure-Resource-Groups-GUI-and-CLI.jpg) ### [Smart Ways to Rename Azure Resource Groups (GUI and CLI)](/rename-azure-resource-group/) Unlock the secret to Rename Azure Resource Groups! Dive into our easy guide for reshaping your Azure landscape with Portal, PowerShell, and CLI techniques. ![](https://adamtheautomator.com/wp-content/uploads/2021/03/azure-cli.jpg) ### [Master Azure CLI: Command Your Cloud with Confidence](/azure-cli/) Unlock the full potential of cloud management with the Azure CLI. This guide provides the essentials to get you started with Azure resources efficiently. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)