> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/rdm/knowledge-base/how-to-articles/configure-an-azure-bastion-entry-in-remote-desktop-manager.md).

# Configure an Azure Bastion entry in Remote Desktop Manager

Configure an Azure Bastion entry in Remote Desktop Manager to reach Azure VMs without public IPs, including IP-based connect and resource overrides.

Microsoft Azure Bastion is a fully managed service providing both Remote Desktop Protocol (RDP) and Secure Shell Protocol (SSH) access to Azure virtual machines (VMs) without their public IP exposure. An hourly billed service, Azure Bastion is tied to a specific Azure Virtual Network, allowing access to all VMs contained within.

Remote Desktop Manager connects to Azure Bastion instances through a VPN/tunnel/gateway entry either per connection or shared amongst many. Once Azure Bastion is deployed, add the necessary details to Remote Desktop Manager, authenticate to Azure, and connect to any VMs within the given Azure virtual network.

### Requirements

Remote Desktop Manager connects through the Azure Bastion native client feature. Before creating entries, make sure the Azure Bastion resource meets these requirements in the Azure portal (Bastion resource – ***Configuration***):

* The **Standard** tier (SKU) or higher. The **Developer** and **Basic** tiers do not support native client connections.
* ***Native Client Support*** is selected.
* To connect to VMs by IP address, ***IP-based connection*** is also enabled. See [Connect to a VM by IP address](#connect-to-a-vm-by-ip-address).

For deployment and configuration steps, refer to the [Microsoft Azure Bastion documentation](https://learn.microsoft.com/en-us/azure/bastion/).

### Connecting Remote Desktop Manager to Azure Bastion

With Azure Bastion meeting the requirements above, you can configure Remote Desktop Manager to connect to VMs behind Azure Bastion. The steps below show the creation of an external Azure Bastion VPN entry that is then linked to a RDP/SSH session entry. This is useful if you plan to use the Azure Bastion entry with multiple session entries.

However, if you plan on using only one session entry with it, you can set up the Azure Bastion configuration directly in that session's properties, under the ***VPN/tunnel/gateway*** section in the left menu. Still, you should follow the steps below, as the configuration and information to provide remains the same.

1. Before connecting, locate the following property details:

   | Property              | Example value                          | Notes                                                                                                                                                                                                                                                                                                                                                                                                                           |
   | --------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | ***Host***            | `VNet1-bastion`                        | The name of the Azure Bastion resource in the Azure portal. It is not the DNS name or the public IP address of the Bastion.                                                                                                                                                                                                                                                                                                     |
   | ***Subscription ID*** | `6f14d593-b33a-48ca-81e5-428eeb0ff8b1` | The subscription in which the Azure Bastion resource is located. Target VMs are assumed to be in the same subscription unless it is overridden in the session entry or its folder (see [Override the subscription ID and resource group](#override-the-subscription-id-and-resource-group)). Locate this value in the Azure portal under ***Subscriptions***: select the subscription and copy the ***Subscription ID*** value. |
   | ***Resource group***  | `Devolutions-202309011056`             | The resource group in which the Virtual Network and attached Bastion object are located. Target VMs are assumed to be in the same resource group unless it is overridden in the session entry or its folder.                                                                                                                                                                                                                    |
   | ***Tenant ID***       | `76377918-3e78-4fd7-b07a-6eb5d4bbf18f` | It is only needed if the Bastion does not exist in the default tenant for the Azure user. Locate this value in the Azure portal under ***Microsoft Entra ID*** – ***Overview***, or enter the tenant domain name (for example, `contoso.onmicrosoft.com`) in the ***Tenant ID*** field in Remote Desktop Manager and click the search button to replace it with the tenant ID.                                                  |
2. With details in hand, open Remote Desktop Manager and navigate to where you want your Azure Bastion entry to be.
3. In the Ribbon, click ***Edit*** – ***Add entry***.
4. Under the ***VPN/tunnel/gateway*** entry types, select ***Azure Bastion*** and click ***Select***.
5. ***Name*** your entry.
6. In the ***General*** sub-tab, enter the information located in step 1 for the ***Host***, ***Subscription ID***, ***Resource group***, and ***Tenant ID***. The ***Subscription ID*** and ***Resource group*** fields support [variables](#use-variables-in-the-subscription-id-and-resource-group).
7. Select the Azure cloud hosting the Bastion in the ***Azure Cloud*** drop-down list (see [Azure cloud options](#azure-cloud-options)).
8. Select a ***Connection mode*** in the corresponding drop-down list (see [Connection modes](#connection-modes)).
9. Open the ***Authentication*** sub-tab and select one or more authentication methods (see [Authentication options](#authentication-options)).
10. If the Azure Bastion must be reached through a proxy, open the ***Proxy*** sub-tab and configure it (see [Proxy settings](#proxy-settings)).
11. Click ***OK*** to save the entry.
12. In the Ribbon, click ***Edit*** – ***Add entry*** again.
13. Under the ***Session*** entry types, select either ***RDP (Microsoft Remote Desktop)*** or ***SSH shell*** and click ***Select***. For this example, an RDP session entry has been used.
14. ***Name*** your entry.
15. In the ***General*** tab, enter the VM name that is within Azure in the ***Host*** field. You can also enter the VM's private IP address instead (see [Connect to a VM by IP address](#connect-to-a-vm-by-ip-address)).
16. Enter the VM ***Username*** and ***Password*** to log in to the VM itself. Leave the ***Domain*** field empty if the VM is not domain-joined.
17. In the left menu, select ***VPN/tunnel/gateway***.
18. In the ***VPN/tunnel/gateway*** tab, under ***General***, select ***Always connect*** in the ***Connect*** drop-down list.
19. In the ***VPN provider*** drop-down list, under ***Existing***, select ***Existing Azure Bastion***.
20. In the ***Session*** field, select the Azure Bastion entry created in steps 3 to 11.
21. Click ***OK*** to save the entry.
22. Launch a connection to the newly added VM.
23. If a Microsoft sign-in prompt opens (interactive authentication with no cached credentials), enter your Azure credentials to open the Azure Bastion connection.

The connection to the VM opens through the Azure Bastion.

{% hint style="danger" %}
You may encounter this error message within Remote Desktop Manager: ***The Azure Bastion does not support native client connections (SKU: Basic, Native Client: False)***. It means that the Bastion is not on the Standard tier or higher, or that ***Native client support*** is not enabled (see [Requirements](#requirements)).

If an ***SSH shell*** session through the Azure Bastion fails to connect on a computer with IPv6 enabled, open the ***Advanced*** tab of the SSH shell entry and set ***Internet protocol*** to ***IPv4***. Azure Bastion connects to target VMs over IPv4 only.
{% endhint %}

#### Azure cloud options

The ***Azure Cloud*** drop-down list of the Azure Bastion entry offers the following values:

| Option                          | Description                                                                         |
| ------------------------------- | ----------------------------------------------------------------------------------- |
| ***Default***                   | Uses the Azure public cloud.                                                        |
| ***Azure Public Cloud***        | Global Azure cloud.                                                                 |
| ***Azure China Cloud***         | Microsoft Azure operated by 21Vianet in China.                                      |
| ***Azure US Government Cloud*** | Azure Government, for US government agencies and their partners.                    |
| ***Azure German Cloud***        | Microsoft Cloud Germany, which Microsoft announced would close on October 29, 2021. |

#### Connection modes

The ***Connection mode*** drop-down list of the Azure Bastion entry offers the following values:

| Option           | Description                                                                                                                                                                                                                                                                           |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| ***Default***    | Uses the mode set in ***File*** – ***Settings*** – ***Entry types*** – ***VPN/tunnel/gateway***, under ***Azure Bastion*** – ***Connection mode***. This global setting is ***TCP Tunnel*** unless it is changed.                                                                     |
| ***TCP Tunnel*** | Opens a tunnel from a local port to the target VM through the Bastion, similar to the `az network bastion tunnel` Azure CLI command; the session connects to this local port. Supports RDP and SSH shell session entries, and [IP-based connections](#connect-to-a-vm-by-ip-address). |
| ***RD Gateway*** | Retrieves the RDP connection settings (gateway host and access token) from the Bastion and connects through the Bastion as a Remote Desktop Gateway. Supports RDP session entries only.                                                                                               |

#### Authentication options

The ***Authentication*** sub-tab contains check boxes; several can be selected. At least one authentication method must be enabled, otherwise the connection fails with the message ***At least one authentication mode must be enabled (SSO or Devolutions Account).***

| Option                                | Description                                                                                                                                                                                                   |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| ***Use "My account settings"***       | Uses the Azure authentication configured in ***File*** – ***My account settings***. When selected, the other options are unavailable. This option is hidden when a policy disables ***My account settings***. |
| ***Use my current PowerShell login*** | Uses the current login context from Azure PowerShell (`Connect-AzAccount`).                                                                                                                                   |
| ***Use my current Azure CLI login***  | Uses the current login context from the Azure CLI (`az login`).                                                                                                                                               |
| ***Prompt for credentials***          | Opens an interactive Azure sign-in in a web browser window. Selected by default. The sign-in is kept in memory and reused for subsequent connections until Remote Desktop Manager is closed.                  |
| ***Username***                        | Optional login hint used to preselect the account in the interactive sign-in. Available when ***Prompt for credentials*** is selected.                                                                        |

#### Proxy settings

The ***Proxy*** sub-tab defines a proxy used to reach Azure. The ***Proxy type*** drop-down list is available only when the ***Connection mode*** is set to ***TCP Tunnel***. The other fields are displayed when the ***Proxy type*** is not ***None***.

| Option                      | Description                                                                                                                                        |
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| ***Proxy type***            | ***None*** (default) connects without a proxy. ***Default*** and ***HTTP*** connect through the HTTP proxy defined in the fields below.            |
| ***Credential repository*** | When the check box is selected, takes the proxy username and password from the credential entry selected in the ***Credential repository*** field. |
| ***Host***                  | Host name or IP address of the proxy server.                                                                                                       |
| ***Port***                  | Port of the proxy server.                                                                                                                          |
| ***Username***              | Username used to authenticate to the proxy. Unavailable when ***Credential repository*** is selected.                                              |
| ***Password***              | Password used to authenticate to the proxy. Unavailable when ***Credential repository*** is selected.                                              |

### Advanced settings

When the VPN type of an RDP or SSH Shell session entry is ***Azure Bastion*** (embedded or linked to an existing Azure Bastion entry), its ***VPN/tunnel/gateway*** tab shows an ***Azure resource*** section. Folders also show this section in their own ***VPN/tunnel/gateway*** properties. These settings control how Remote Desktop Manager locates the target VM in Azure.

#### Connect to a VM by IP address

Instead of a VM name, the ***Host*** field of the session entry can contain the VM's private IP address. When the host is an IP address, Remote Desktop Manager automatically uses the Azure Bastion IP-based connection feature. This requires:

* ***IP-based connection*** enabled on the Azure Bastion resource, in addition to the [requirements](#requirements) above.
* The ***TCP Tunnel*** connection mode. The ***RD Gateway*** mode does not support IP-based connections.

If these conditions are not met, the connection fails with the following message: ***The Azure Bastion or the current connection mode does not support IP-based client connections.***

Microsoft does not support custom ports for native client connections by IP address.

#### Override the subscription ID and resource group

By default, Remote Desktop Manager looks for the target VM in the subscription and resource group entered in the Azure Bastion entry (or in the Azure Bastion settings embedded in the session entry). When a VM is in a different subscription or resource group than the Bastion, change the following settings in the ***Azure resource*** section of the session entry:

* ***Subscription ID***: the subscription containing the VM.
* ***Resource group***: the resource group containing the VM.

Each setting offers three modes:

| Mode            | Description                                                                                                                                                                     |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| ***Default***   | Uses the value entered in the Azure Bastion entry.                                                                                                                              |
| ***Inherited*** | Uses the value defined on the parent folders (see [Inherit the subscription ID and resource group from folders](#inherit-the-subscription-id-and-resource-group-from-folders)). |
| ***Custom***    | Uses the value entered in the text box displayed next to the mode.                                                                                                              |

The subscription ID and the resource group are resolved independently; for example, you can keep the subscription on ***Default*** and override only the resource group.

The same section also contains the ***Scale set*** and ***Instance ID*** settings, used to target one instance of a virtual machine scale set, and, for RDP entries, the ***Use entry name as Azure Resource name*** option, which uses the entry name instead of the ***Host*** value as the VM name in Azure.

#### Inherit the subscription ID and resource group from folders

To avoid repeating the same values in many session entries, set the ***Subscription ID*** and ***Resource group*** once in the ***Azure resource*** section of a folder's ***VPN/tunnel/gateway*** properties, then set the session entries to ***Inherited***.

When a session entry is set to ***Inherited***, Remote Desktop Manager goes up the folder hierarchy, starting with the closest parent folder:

* A folder set to ***Custom*** provides its value, and the search stops.
* A folder set to ***Default*** stops the search, and the value entered in the Azure Bastion entry is used.
* A folder set to ***Inherited*** passes the search on to its own parent folder.

If no folder provides a value, the value entered in the Azure Bastion entry is used.

#### Use variables in the subscription ID and resource group

The ***Subscription ID*** and ***Resource group*** values support [variables](/rdm/knowledge-base/knowledge-base-articles/access-and-manage-variables.md), in both the Azure Bastion entry and the ***Azure resource*** section of session entries and folders. For example, if your folders are named after your resource groups, entering `$ROOT_GROUP$` as a ***Custom*** resource group in a session entry uses the name of the entry's top-level folder.

Variables are resolved in the context of the entry or folder where the value is defined. A variable entered in a linked Azure Bastion entry is therefore resolved against the Azure Bastion entry itself, not against the session entry. To use values based on the session entry (such as its folder), define them with the ***Custom*** mode in the session entry.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/rdm/knowledge-base/how-to-articles/configure-an-azure-bastion-entry-in-remote-desktop-manager.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.