Configure an Azure Bastion entry in Remote Desktop Manager

Microsoft Azure Bastion is a fully managed service providing both Remote Desktop Protocol (RDP) and Secure Shell Protocol (SSH) access to Azure virtual machines (VMs) without their public IP exposure. An hourly billed service, Azure Bastion is tied to a specific Azure Virtual Network, allowing access to all VMs contained within.

Remote Desktop Manager connects to Azure Bastion instances through a VPN/tunnel/gateway entry either per connection or shared amongst many. Once Azure Bastion is deployed, add the necessary details to Remote Desktop Manager, authenticate to Azure, and connect to any VMs within the given Azure virtual network.

Requirements

Remote Desktop Manager connects through the Azure Bastion native client feature. Before creating entries, make sure the Azure Bastion resource meets these requirements in the Azure portal (Bastion resource – Configuration):

• The Standard tier (SKU) or higher. The Developer and Basic tiers do not support native client connections.
• Native Client Support is selected.
• To connect to VMs by IP address, IP-based connection is also enabled. See Connect to a VM by IP address.

For deployment and configuration steps, refer to the Microsoft Azure Bastion documentation.

Connecting Remote Desktop Manager to Azure Bastion

With Azure Bastion meeting the requirements above, you can configure Remote Desktop Manager to connect to VMs behind Azure Bastion. The steps below show the creation of an external Azure Bastion VPN entry that is then linked to a RDP/SSH session entry. This is useful if you plan to use the Azure Bastion entry with multiple session entries.

However, if you plan on using only one session entry with it, you can set up the Azure Bastion configuration directly in that session's properties, under the VPN/tunnel/gateway section in the left menu. Still, you should follow the steps below, as the configuration and information to provide remains the same.

1. Before connecting, locate the following property details:

   Property	Example value	Notes
   Host	VNet1-bastion	The name of the Azure Bastion resource in the Azure portal. It is not the DNS name or the public IP address of the Bastion.
   Subscription ID	6f14d593-b33a-48ca-81e5-428eeb0ff8b1	The subscription in which the Azure Bastion resource is located. Target VMs are assumed to be in the same subscription unless it is overridden in the session entry or its folder (see Override the subscription ID and resource group). Locate this value in the Azure portal under Subscriptions: select the subscription and copy the Subscription ID value.
   Resource group	Devolutions-202309011056	The resource group in which the Virtual Network and attached Bastion object are located. Target VMs are assumed to be in the same resource group unless it is overridden in the session entry or its folder.
   Tenant ID	76377918-3e78-4fd7-b07a-6eb5d4bbf18f	It is only needed if the Bastion does not exist in the default tenant for the Azure user. Locate this value in the Azure portal under Microsoft Entra ID – Overview, or enter the tenant domain name (for example, contoso.onmicrosoft.com) in the Tenant ID field in Remote Desktop Manager and click the search button to replace it with the tenant ID.

2. With details in hand, open Remote Desktop Manager and navigate to where you want your Azure Bastion entry to be.
3. In the Ribbon, click Edit – Add entry.
4. Under the VPN/tunnel/gateway entry types, select Azure Bastion and click Select.
5. Name your entry.
6. In the General sub-tab, enter the information located in step 1 for the Host, Subscription ID, Resource group, and Tenant ID. The Subscription ID and Resource group fields support variables.
7. Select the Azure cloud hosting the Bastion in the Azure Cloud drop-down list (see Azure cloud options).
8. Select a Connection mode in the corresponding drop-down list (see Connection modes).
9. Open the Authentication sub-tab and select one or more authentication methods (see Authentication options).
10. If the Azure Bastion must be reached through a proxy, open the Proxy sub-tab and configure it (see Proxy settings).
11. Click OK to save the entry.
12. In the Ribbon, click Edit – Add entry again.
13. Under the Session entry types, select either RDP (Microsoft Remote Desktop) or SSH shell and click Select. For this example, an RDP session entry has been used.
14. Name your entry.
15. In the General tab, enter the VM name that is within Azure in the Host field. You can also enter the VM's private IP address instead (see Connect to a VM by IP address).
16. Enter the VM Username and Password to log in to the VM itself. Leave the Domain field empty if the VM is not domain-joined.
17. In the left menu, select VPN/tunnel/gateway.
18. In the VPN/tunnel/gateway tab, under General, select Always connect in the Connect drop-down list.
19. In the VPN provider drop-down list, under Existing, select Existing Azure Bastion.
20. In the Session field, select the Azure Bastion entry created in steps 3 to 11.
21. Click OK to save the entry.
22. Launch a connection to the newly added VM.
23. If a Microsoft sign-in prompt opens (interactive authentication with no cached credentials), enter your Azure credentials to open the Azure Bastion connection.

The connection to the VM opens through the Azure Bastion.

You may encounter this error message within Remote Desktop Manager: The Azure Bastion does not support native client connections (SKU: Basic, Native Client: False). It means that the Bastion is not on the Standard tier or higher, or that Native client support is not enabled (see Requirements).

If an SSH shell session through the Azure Bastion fails to connect on a computer with IPv6 enabled, open the Advanced tab of the SSH shell entry and set Internet protocol to IPv4. Azure Bastion connects to target VMs over IPv4 only.

Azure cloud options

The Azure Cloud drop-down list of the Azure Bastion entry offers the following values:

Option	Description
Default	Uses the Azure public cloud.
Azure Public Cloud	Global Azure cloud.
Azure China Cloud	Microsoft Azure operated by 21Vianet in China.
Azure US Government Cloud	Azure Government, for US government agencies and their partners.
Azure German Cloud	Microsoft Cloud Germany, which Microsoft announced would close on October 29, 2021.

Connection modes

The Connection mode drop-down list of the Azure Bastion entry offers the following values:

Option	Description
Default	Uses the mode set in File – Settings – Entry types – VPN/tunnel/gateway, under Azure Bastion – Connection mode. This global setting is TCP Tunnel unless it is changed.
TCP Tunnel	Opens a tunnel from a local port to the target VM through the Bastion, similar to the az network bastion tunnel Azure CLI command; the session connects to this local port. Supports RDP and SSH shell session entries, and IP-based connections.
RD Gateway	Retrieves the RDP connection settings (gateway host and access token) from the Bastion and connects through the Bastion as a Remote Desktop Gateway. Supports RDP session entries only.

Authentication options

The Authentication sub-tab contains check boxes; several can be selected. At least one authentication method must be enabled, otherwise the connection fails with the message At least one authentication mode must be enabled (SSO or Devolutions Account).

Option	Description
Use "My account settings"	Uses the Azure authentication configured in File – My account settings. When selected, the other options are unavailable. This option is hidden when a policy disables My account settings.
Use my current PowerShell login	Uses the current login context from Azure PowerShell (Connect-AzAccount).
Use my current Azure CLI login	Uses the current login context from the Azure CLI (az login).
Prompt for credentials	Opens an interactive Azure sign-in in a web browser window. Selected by default. The sign-in is kept in memory and reused for subsequent connections until Remote Desktop Manager is closed.
Username	Optional login hint used to preselect the account in the interactive sign-in. Available when Prompt for credentials is selected.

Proxy settings

The Proxy sub-tab defines a proxy used to reach Azure. The Proxy type drop-down list is available only when the Connection mode is set to TCP Tunnel. The other fields are displayed when the Proxy type is not None.

Option	Description
Proxy type	None (default) connects without a proxy. Default and HTTP connect through the HTTP proxy defined in the fields below.
Credential repository	When the check box is selected, takes the proxy username and password from the credential entry selected in the Credential repository field.
Host	Host name or IP address of the proxy server.
Port	Port of the proxy server.
Username	Username used to authenticate to the proxy. Unavailable when Credential repository is selected.
Password	Password used to authenticate to the proxy. Unavailable when Credential repository is selected.

Advanced settings

When the VPN type of an RDP or SSH Shell session entry is Azure Bastion (embedded or linked to an existing Azure Bastion entry), its VPN/tunnel/gateway tab shows an Azure resource section. Folders also show this section in their own VPN/tunnel/gateway properties. These settings control how Remote Desktop Manager locates the target VM in Azure.

Connect to a VM by IP address

Instead of a VM name, the Host field of the session entry can contain the VM's private IP address. When the host is an IP address, Remote Desktop Manager automatically uses the Azure Bastion IP-based connection feature. This requires:

• IP-based connection enabled on the Azure Bastion resource, in addition to the requirements above.
• The TCP Tunnel connection mode. The RD Gateway mode does not support IP-based connections.

If these conditions are not met, the connection fails with the following message: The Azure Bastion or the current connection mode does not support IP-based client connections.

Microsoft does not support custom ports for native client connections by IP address.

Override the subscription ID and resource group

By default, Remote Desktop Manager looks for the target VM in the subscription and resource group entered in the Azure Bastion entry (or in the Azure Bastion settings embedded in the session entry). When a VM is in a different subscription or resource group than the Bastion, change the following settings in the Azure resource section of the session entry:

• Subscription ID: the subscription containing the VM.
• Resource group: the resource group containing the VM.

Each setting offers three modes:

Mode	Description
Default	Uses the value entered in the Azure Bastion entry.
Inherited	Uses the value defined on the parent folders (see Inherit the subscription ID and resource group from folders).
Custom	Uses the value entered in the text box displayed next to the mode.

The subscription ID and the resource group are resolved independently; for example, you can keep the subscription on Default and override only the resource group.

The same section also contains the Scale set and Instance ID settings, used to target one instance of a virtual machine scale set, and, for RDP entries, the Use entry name as Azure Resource name option, which uses the entry name instead of the Host value as the VM name in Azure.

Inherit the subscription ID and resource group from folders

To avoid repeating the same values in many session entries, set the Subscription ID and Resource group once in the Azure resource section of a folder's VPN/tunnel/gateway properties, then set the session entries to Inherited.

When a session entry is set to Inherited, Remote Desktop Manager goes up the folder hierarchy, starting with the closest parent folder:

• A folder set to Custom provides its value, and the search stops.
• A folder set to Default stops the search, and the value entered in the Azure Bastion entry is used.
• A folder set to Inherited passes the search on to its own parent folder.

If no folder provides a value, the value entered in the Azure Bastion entry is used.

Use variables in the subscription ID and resource group

The Subscription ID and Resource group values support variables, in both the Azure Bastion entry and the Azure resource section of session entries and folders. For example, if your folders are named after your resource groups, entering $ROOT_GROUP$ as a Custom resource group in a session entry uses the name of the entry's top-level folder.

Variables are resolved in the context of the entry or folder where the value is defined. A variable entered in a linked Azure Bastion entry is therefore resolved against the Azure Bastion entry itself, not against the session entry. To use values based on the session entry (such as its folder), define them with the Custom mode in the session entry.