Azure Bastion: Secure Remote Access Without Exposing RDP/SSH

by

Introduction

One of the biggest mistakes I’ve seen in cloud environments is leaving Remote Desktop Protocol (RDP) or SSH ports open to the internet. It feels convenient, but it’s like leaving your front door unlocked in a busy city — someone will try to walk in.

Azure Bastion solves this problem by providing secure, seamless RDP and SSH connectivity directly through the Azure Portal, without exposing VMs to the internet. For administrators, Bastion is a straightforward way to strengthen security while maintaining productivity. For recruiters, it demonstrates that you understand how to protect access points — one of the highest-value skills in system administration today.

Why Bastion Matters

  • No public IPs required: VMs stay private, reducing attack surface.
  • Seamless experience: Connect through the Azure Portal with a browser-based session.
  • Policy alignment: Supports enterprise security strategies like Zero Trust.
  • Reduced risk: Eliminates brute-force attacks on open RDP/SSH ports.

I’ve worked in environments where auditors flagged dozens of exposed RDP ports. Implementing Bastion was a simple but powerful fix — we closed public ports across the board, while admins and support staff could still manage systems securely. The audit team was happy, and the security team was thrilled.

Deploying Azure Bastion with CLI

Step 1: Create a Virtual Network

bash

az network vnet create \
  --resource-group MyResourceGroup \
  --name MyVNet \
  --address-prefix 10.0.0.0/16 \
  --subnet-name AzureBastionSubnet \
  --subnet-prefix 10.0.0.0/27

Note: Bastion requires a dedicated subnet named AzureBastionSubnet.

Step 2: Create a Public IP for Bastion

bash

az network public-ip create \
  --resource-group MyResourceGroup \
  --name MyBastionIP \
  --sku Standard \
  --location eastus

Step 3: Deploy Bastion

bash

az network bastion create \
  --name MyBastionHost \
  --public-ip-address MyBastionIP \
  --resource-group MyResourceGroup \
  --vnet-name MyVNet \
  --location eastus

Once deployed, you can connect to any VM in the VNet through the portal — no need for public IPs or NSG rules exposing RDP/SSH.

Best Practices I’ve Learned

  • Always use Bastion for admin access in production — never expose RDP/SSH to the internet.
  • Combine Bastion with Just-In-Time (JIT) access in Defender for Cloud for layered security.
  • Ensure logs are enabled to track connection activity.
  • Limit Bastion access with RBAC to admins who truly need it.
  • Use MFA at the account level so Bastion sessions are protected by strong authentication.

Recruiter’s Perspective

From a recruiter’s point of view, Bastion experience signals that you:

  • Understand real-world risks and how to mitigate them.
  • Prioritize secure access over convenience.
  • Can design solutions that satisfy auditors, compliance, and security teams.

In an interview, saying “I eliminated open RDP ports by deploying Azure Bastion, reducing attack surface and passing compliance checks” shows not just technical know-how, but strategic thinking — you’re protecting the organization while keeping admins productive.

Conclusion

Azure Bastion makes secure remote access simple. It closes one of the most common security gaps in cloud environments by keeping RDP/SSH ports off the internet while still giving administrators easy access.

For administrators, it’s a must-have tool that proves you take security seriously. For recruiters, it highlights a candidate who understands how to balance usability and risk reduction — exactly what modern IT teams are looking for.

Leave a Comment