Azure Bastion Standard SKU provides Basic secure RDP and SSH connectivity plus advanced connection controls. It supports RDP to Linux VMs, SSH to Windows VMs, Azure Key Vault private-key authentication, file upload and download, and disabling copy and paste in web clients. Select the Standard SKU through the Azure portal when these capabilities are required. section 4.2.1
Configure Standard SKU capacity and connectivity with these requirements:
- Deploy Bastion in a dedicated AzureBastionSubnet in the same VNet and resource group; use a subnet of /26 or larger when host scaling is needed. section 4.2.2
- Choose the number of Bastion instances to increase concurrent session capacity; each instance supports 25 concurrent RDP and 50 concurrent SSH connections for commonly used workloads. section 4.2.2
- Use an unused Standard SKU public IP address for Bastion; the public endpoint provides secure RDP and SSH access over port 443. section 4.2.2
- Enable native client support with the Azure portal or az network bastion update --enable-tunneling; native RDP and SSH connections also require appropriate Reader roles and open VM ports. section 4.2.4
Enable native client support
Run az network bastion update with the Bastion name, resource group, and --enable-tunneling. A successful response reports enableTunneling as true. You can then use az network bastion rdp or az network bastion ssh to connect to a target VM.
