Connect to an Azure VM Using the Native RDP Client Through Bastion

Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP/SSH connectivity to your virtual machines directly over TLS from the Azure portal, or via the native SSH or RDP client already installed on your local computer.

Introduction

Official documentation is available here: Azure Bastion overview .

Native client support is a feature in Azure Bastion that lets you use native SSH and RDP programs to connect to Bastion instead of using the Azure Bastion web interface.

Prerequisites

Azure Bastion deployed

Note

Native client support must be enabled on Bastion to create the tunnel.

Azure Bastion native client support

Instead of logging in through the Azure portal, Azure Bastion now allows users to connect using their native RDP or SSH clients.

Go to Bastion → Settings → Configuration → Native client support.

Enabling native client support in the Bastion configuration settings

Create the RDP tunnel

Open a terminal:

bash

az login --tenant <your_tenant_id> --use-device-code
az account set --subscription <your_subscription_id>

Define your variables to target the VM to connect to:

bash

$BastionName = "bstbga01"
$BastionRG = "rg-bst"
$TargetVmResourceId = "/subscriptions/xxx-xxx-xxx-xxx/resourceGroups/rg-vm/providers/Microsoft.Compute/virtualMachines/vmapp001"

Note

To get the VM resource ID, go to Virtual machines → select your VM → Overview → JSON View → copy the resource ID.

Copying the VM resource ID from the JSON view

Create the tunnel:

bash

az network bastion tunnel --name $BastionName `
    --resource-group $BastionRG `
    --target-resource-id $TargetVmResourceId `
    --resource-port "3389" `
    --port "50022" `
    --subscription xxx-xxx-xxx-xxx

The Bastion tunnel command running and listening on the local port

Open an RDP connection to the VM:

bash

mstsc /v:127.0.0.1:50022

Launching mstsc against the local tunnel endpoint

RDP client connecting through the Bastion tunnel

RDP certificate warning during the Bastion tunnel connection

Successful RDP session on the target VM through Bastion

You should now be connected to the target VM through the Azure Bastion tunnel. You can use this connection to manage the VM as needed.

Warning

Don't forget to close the tunnel when you're done by pressing Ctrl+C in the terminal where you started it — otherwise it keeps running and listening on the local port.

Enjoy!