Key points

• Managed service for RDP or SSH access to VMs over private IPs.
• Target VMs do not require public IP addresses for Bastion sessions.
• User RBAC, guest credentials, VNet reachability, and permitted management ports still apply.

Best-known use cases

• Administer private VMs from the Azure portal.
• Remove direct internet exposure from VM management ports.

What candidates often confuse it with

• Bastion vs jump host: managed Azure access service vs customer-operated intermediary VM.
• Bastion vs public IP: private-path administration vs direct internet address exposure.

Key takeaway

Use Azure Bastion for managed private VM administration without public IPs on the target machines.

Related services

• Network security groups and application security groups

Relevant exam tasks

• D4.2.S1 — Create and configure network security groups (NSGs) and application security groups
• D4.2.S2 — Evaluate effective security rules in NSGs
• D4.2.S3 — Implement Azure Bastion

Learn more

• Azure Bastion documentation