Edit

Share via

Create an RDP connection to a Windows VM using Azure Bastion

This article describes how to create a secure RDP connection to your Windows virtual machines using Azure Bastion. You can connect through the Azure portal (browser-based), via a specified IP address, or using a native client on your local Windows computer. When you use Azure Bastion, your virtual machines don't require a client, agent, or additional software. Azure Bastion securely connects to all virtual machines in the virtual network without exposing RDP/SSH ports to the public internet. For more information, see What is Azure Bastion?

For native client connections using Azure CLI (including SSH and tunnel), see Connect to a VM using a native client. To connect to a Windows virtual machine using SSH, see Create an SSH connection to a Windows VM.

The following diagram shows the dedicated deployment architecture using an RDP connection.

Diagram that shows the Azure Bastion architecture.

Prerequisites

Before you begin, verify that you meet the following criteria:

  • An Azure Bastion host deployed in the virtual network where the virtual machine is located, or in a peered virtual network. To set up a Bastion host, see Create a bastion host. The SKU you need depends on your connection method:

    Connection method Minimum SKU Additional configuration
    Azure portal (browser) Basic None
    Azure portal with custom ports Standard None
    IP-based connection Standard IP-based connection enabled
    Native client (RDP) Standard Native client support enabled

  • Users connecting via RDP must have rights on the target virtual machine. If the user isn't a local administrator, add them to the Remote Desktop Users group.

  • Azure Bastion uses RDP port 3389 by default. Custom ports require the Standard SKU or higher. To upgrade, see Upgrade a SKU.

  • A Windows virtual machine in the virtual network (or reachable from the virtual network for IP-based connections).

  • Required roles:

    • Reader role on the virtual machine.
    • Reader role on the NIC with the IP of the virtual machine.
    • Reader role on the Azure Bastion resource.
    • Reader role on the virtual network of the target virtual machine (if the Bastion deployment is in a peered virtual network).
    • Virtual Machine Administrator Login or Virtual Machine User Login role (only required for Microsoft Entra ID authentication).

See the Azure Bastion FAQ for additional requirements.

Authentication methods

The following authentication methods are available for RDP connections through Azure Bastion. Select an authentication method to see the corresponding steps.

Authentication method Supported connection methods Minimum SKU
Microsoft Entra ID (Preview) (Preview for RDP) Azure portal, native client Basic (portal), Standard (native client)
Username and password Azure portal, IP address (portal), native client Basic (portal), Standard (IP address, native client)
Kerberos Azure portal Basic

Connect to a virtual machine using RDP

Select a connection method to see the corresponding steps. After you navigate to the Bastion connection page, choose your authentication method.

Use the Azure portal to create a browser-based RDP connection to your Windows virtual machine. This method connects directly through your browser. No native RDP client or additional software is required on your local computer. The Basic SKU or higher is required, or the Standard SKU if you need custom ports.

  1. In the Azure portal, select your virtual machine. On the left pane select Connect, then select Bastion.

  2. In the Connection settings tab, select RDP as the protocol, and enter the port number if you changed it from the default of 3389.

  3. Select your authentication method. Microsoft Entra ID (Preview) is recommended. For other options, see Authentication methods.

  4. Select Connect to open the RDP connection to your virtual machine in a new browser tab.

Note

For troubleshooting tips, see Troubleshooting RDP connections and Troubleshoot Microsoft Entra sign in for a Windows virtual machine in Azure or Arc-enabled Windows Server

Limitations

  • IP-based connections: IP-based connection doesn't work with force tunneling over VPN, or when a default route is advertised over an ExpressRoute circuit. Azure Bastion requires access to the Internet and force tunneling, or the default route advertisement, results in traffic blackholing.
  • IP-based connections: UDR isn't supported on the Bastion subnet, including with IP-based connections.
  • IP-based connections: Custom ports and protocols aren't currently supported when connecting to a virtual machine via native client with IP-based connections.
  • Microsoft Entra ID: Microsoft Entra authentication isn't supported for IP-based RDP connections. IP-based SSH connections via native client do support Entra ID authentication. For Entra ID auth details, see About Microsoft Entra ID authentication.
  • Session recording: RDP + Entra ID authentication in the portal can't be used concurrently with graphical session recording.

Next steps

  • Last updated on