---
cuppy_hub: azure
cuppy_path: reference/networking/bastion.md
cuppy_section: docs
cuppy_doc: 891H-GZ4M
cuppy_doc_uuid: f1d7092d-ac60-46f6-94a1-5e9f6aa303b3
cuppy_permalink: https://cuppy.io/azure/d/891H-GZ4M
cuppy_version: 1
cuppy_updated: 2026-10-23T16:16:52.575Z
cuppy_canonical: https://cuppy.io/azure/docs/reference/networking/bastion
cuppy_mcp: https://cuppy.io/mcp
cuppy_body_sha256: eea541c3ea8acbc4aef01a915ca6a340572d740525f34a5dff0f512acbb7666c
# cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks.
---


# Azure Bastion

## SKUs

| | Developer | Basic | Standard | Premium |
|---|---|---|---|---|
| `AzureBastionSubnet` / public IP | No / No (shared infrastructure, free) | Yes / Yes | Yes / Yes | Yes / No if private-only |
| VMs in peered VNets, concurrent sessions | No | Yes | Yes | Yes |
| RDP to Linux, SSH to Windows, custom ports | No | No | Yes | Yes |
| Native client (CLI), file transfer, IP-based connect, shareable links | No | No | Yes | Yes |
| Private-only deployment, session recording | No | No | No | Yes |

**Downgrading isn't supported.** Upgrades go up a tier (about 10 minutes) and need Contributor or Owner on the resource group; from Developer you must first create `AzureBastionSubnet`. New features stay off after an upgrade until you enable them under **Configuration**.

## The subnet and its NSG

`AzureBastionSubnet`, **/26 or larger** (bigger allows more scale units), Standard public IP. If you put an NSG on it, it needs all of these:

| Direction | Source → destination | Ports |
|---|---|---|
| Inbound | `Internet` (or your public ranges) → any | 443 |
| Inbound | `GatewayManager` → any | 443 |
| Inbound | `AzureLoadBalancer` → any | 443 |
| Inbound | `VirtualNetwork` → `VirtualNetwork` | 8080, 5701 |
| Outbound | any → `VirtualNetwork` (target VMs) | 22, 3389 (and custom ports) |
| Outbound | any → `AzureCloud` | 443 |
| Outbound | `VirtualNetwork` → `VirtualNetwork` | 8080, 5701 |
| Outbound | any → `Internet` | 80 |

Target VMs need **22/3389 open from the Bastion subnet**, not from the internet.

## Failures

| Symptom | Cause → fix |
|---|---|
| Portal **Deploy Bastion**: `Failed to add subnet` | Create `AzureBastionSubnet` yourself first |
| Sessions fail after adding a default route | **Forced tunnelling isn't supported**: no 0.0.0.0/0 UDR to an NVA on `AzureBastionSubnet`, and don't propagate a default route from VPN, ExpressRoute or Route Server to it |
| Sessions fail when `privatelink.azure.com` is linked to the Bastion VNet | `management.azure.com` then resolves into that zone. Add a CNAME `management` → `arm-frontdoor-prod.trafficmanager.net` in it |
| A VM in a peered VNet doesn't appear | The user needs **Reader** on the VM, its NIC, the Bastion resource and the peered VNet |
| Connection blocked | A missing NSG rule from the table above, Azure Firewall in the path, or the guest firewall |
| Session starts then fails | Target VM stopped, RDP or SSH service down, VM agent unhealthy, NLA settings, guest firewall |
| Moving the VNet to another resource group | Not supported with Bastion in it: delete Bastion, move, redeploy |


---
<!-- cuppy -->
You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.
<!-- /cuppy -->