Azure Bastion

Name: Azure Bastion
Brand: Microsoft
Rating: 4.3 (21 reviews)

Azure Bastion is a fully managed PaaS jump host that provides RDP and SSH connectivity to Azure virtual machines without requiring public IP addresses, enabling portal-initiated and selective native-client connections while eliminating inbound RDP/SSH exposure from the internet.

Est 1975|Valuation $2888.5B|Raised $72.9B

LinkedIn 29.0M|Website|Web traffic 1233.4M|FTEs 232,851|HQ Redmond, Washington, US

MarketsPrivileged Access Management (PAM)Security Service Edge (SSE)Privileged Access Management (PAM)Desktop as a Service (DaaS)

01Common complaints

- Small dev/test, training, or personal projects - Community feedback frequently indicates Bastion is considered expensive when used intermittently but left provisioned. - When VPN is already required/standard and cost-sensitive - Some practitioners argue a basic VPN gateway can be cheaper depending on usage and requirements, though it adds client/network overhead. - When you need third-party access without Azure portal accounts AND require strong MFA/Conditional Access enforcement on that entry point - Multiple threads highlight concerns that shareable links may not meet typical MFA expectations; if an organization cannot accept that risk, alternatives should be considered. - When you need broader privileged access management across servers/Kubernetes/databases across multiple environments - Tools like Teleport (or full PAM solutions) may be a better fit if the core requirement is identity-first access governance rather than Azure-native VM console access. - When you need session recording via native client or need Entra ID portal RDP auth simultaneously with session recording - Microsoft documents constraints: session recording is Premium-only, not available via native client, and can’t run concurrently with certain Entra ID portal RDP auth modes. - Cost model friction - The Bastion resource charges accrue while provisioned, not just while connected; this is a persistent community complaint. - Shareable link security concerns - Repeated concerns about MFA/Conditional Access expectations for shareable links. - Some users also ask about restricting shareable link access by IP and run into limitations/complexity. - Session recording constraints (Premium) - Premium required. - Entra ID support for RDP sessions in portal can’t be used concurrently with graphical session recording. - Not available via native client. - Storage policy constraints are explicitly called out (for example immutable storage policies must not be present; blob versioning constraints). - Reliability / troubleshooting - Community reports of sessions reaching Bastion but failing to connect to the VM, with limited diagnostic clarity. - Security incidents (historical) - Public reporting (June 2023) described XSS-related vulnerabilities involving Azure Bastion and other Azure services; while likely remediated, it is relevant for risk reviews and reinforces the need for defense-in-depth.

Deal disqualifiers (poor fit)

Very small environments with infrequent access where recurring always-on costs dominate.
Requirements for strong MFA/Conditional Access controls for “shareable link” access patterns that the organization cannot otherwise compensate for.
Multi-cloud or on-prem interactive access needs beyond Azure VMs (Bastion is designed for Azure VNets).

03Field reports

Review-platform sentiment (G2)

- Positive themes (examples) - Ease of access and convenience - G2 reviewer (Software Engineer, 6/22/2022): “it’s very simple to use… only use my browser to connect a VM… helpful since I work from home.” - Security and reduced exposure - Multiple G2 reviews emphasize secure RDP/SSH without public IPs. - Negative themes / criticisms (examples) - Documentation and learning curve - Same G2 reviewer notes: “The documents is a little bit impractical so it takes me some time to understand it…” - Complexity and pricing - G2 reviewer (Sr. Technical specialist, 6/25/2022) states: “I feel it is bit of complex on operation. Pricing also can [be] simplified further…” - Portal dependency - G2 reviewer (Founder, 6/17/2022): “We need this out of Azure Portal. We can use it only in Azure Portal.”

Gartner Peer Insights (access limitations)

Gartner Peer Insights page for Azure Bastion was accessible for high-level product/pricing description, but detailed individual review quotes were not captured in the tool output.
Gartner’s listing describes Bastion as enabling secure remote connectivity to VMs without exposing them via public IPs, supporting centralized auditing, and using a consumption-based pricing model with usage-based components.

Community discussions (Reddit) — common themes and quotes

- Positive / “does what it promises” - Reddit user reported: “Been using Bastion since [it] went into public preview, it does exactly what it promises! Secure access via the Azure Portal so you can enable MFA, no need for VPN’s, and easy to set up.” - Pricing shock and confusion (frequent) - Reddit threads repeatedly describe Bastion as “crazy expensive” for learning/testing or small environments. - Example (Azure subreddit): “Just got my first bill for Azure… Bastion bill was much higher than expected.” - Another user: “I deployed Azure Bastion… I noticed a large portion of my usage was Bastion.” - Shareable links and MFA / Conditional Access concerns - Multiple threads indicate buyers want “shareable link” access for third parties but are concerned about lack of MFA/Conditional Access behavior in that mode. - Example: “Ideally we don’t want the 3rd parties to log into our Azure portal… shareable links… doesn’t seem to be a secure way as there is no MFA.” - Reliability / troubleshooting pain - Recent thread (“Bastion Failures”, 2026) describes sessions reaching Bastion but failing to reach the VM, with limited visibility into what’s wrong: “azure networking is a black box.”

Why some customers consider leaving / avoiding (churn drivers)

Ongoing cost when left provisioned continuously, especially for small environments.
Security/governance concerns around shareable links (MFA/CA expectations).
Feature gaps depending on SKU (advanced features in Premium; limitations around native client/session recording interplay).

Vendor/official case studies

The Azure Bastion product pages include “customer stories/cases” sections, but the accessible snippets in this research set did not include detailed, independently verifiable ROI numbers.

What can be stated from official documentation (not ROI)

Microsoft describes Bastion as reducing exposure to port scanning and brute-force attacks by removing the VM public IP requirement for RDP/SSH.

Critical evaluation / gaps

Quantified ROI claims specific to Azure Bastion (time saved, breach reduction, cost savings versus jumpboxes) were not found with clear methodology in the sources captured.
Where security outcomes are claimed (for example “protect from threats”), they should be treated as plausible benefits rather than guaranteed measurable results without an organization-specific risk model.

04Best fit

Company sizes

Well suited for: mid-market to enterprise teams with dedicated cloud/network/security ownership — typically organizations rather than single-person projects — that require standardized access and auditing.
Less ideal for solo learners or hobbyists due to recurring provisioning costs that can be disproportionate for very small, infrequent-use scenarios.

Industries

Any regulated or security-sensitive industry running workloads on Azure (examples include financial services, healthcare, public sector, and SaaS) where eliminating public management ports is a priority.

Roles and personas

Decision makers: cloud platform owners, security leadership, network engineering leads.
End users: SREs, sysadmins, DevOps engineers, incident responders.

Pain points addressed

Removing public RDP/SSH exposure.
Reducing the need to maintain jumpbox VMs.
Centralizing access controls via Azure RBAC.

Qualification criteria (well suited)

Azure-first footprint with many VMs where standardized administrative access is required.
Organizations willing to pay for managed convenience and reduced operational burden.
Need for session recording and auditing (Premium SKU) and willingness to manage supporting storage securely.

05The pitch

What the product does (core value proposition in objective terms)

Azure Bastion is a fully managed jump host (PaaS) that provides RDP and SSH connectivity to Azure virtual machines without requiring public IP addresses on the VMs and without opening inbound RDP/SSH from the internet.
Connections are initiated from the Azure Portal (browser-based) and, depending on SKU/features, can also be initiated via native RDP/SSH clients for some scenarios.

Target market and market positioning

Target users: Azure administrators, cloud/network/security engineers, and platform teams who need interactive VM access for operations and troubleshooting.
Positioning: a managed alternative to self-managed bastion/jumpbox VMs and (in some designs) an alternative to requiring VPN for administrative access.

01Common complaints

Small dev/test, training, or personal projects
- Community feedback frequently indicates Bastion is considered expensive when used intermittently but left provisioned.
When VPN is already required/standard and cost-sensitive
- Some practitioners argue a basic VPN gateway can be cheaper depending on usage and requirements, though it adds client/network overhead.
When you need third-party access without Azure portal accounts AND require strong MFA/Conditional Access enforcement on that entry point
- Multiple threads highlight concerns that shareable links may not meet typical MFA expectations; if an organization cannot accept that risk, alternatives should be considered.
When you need broader privileged access management across servers/Kubernetes/databases across multiple environments
- Tools like Teleport (or full PAM solutions) may be a better fit if the core requirement is identity-first access governance rather than Azure-native VM console access.
When you need session recording via native client or need Entra ID portal RDP auth simultaneously with session recording
- Microsoft documents constraints: session recording is Premium-only, not available via native client, and can’t run concurrently with certain Entra ID portal RDP auth modes.
Cost model friction
- The Bastion resource charges accrue while provisioned, not just while connected; this is a persistent community complaint.
Shareable link security concerns
- Repeated concerns about MFA/Conditional Access expectations for shareable links.
- Some users also ask about restricting shareable link access by IP and run into limitations/complexity.
Session recording constraints (Premium)
- Premium required.
- Entra ID support for RDP sessions in portal can’t be used concurrently with graphical session recording.
- Not available via native client.
- Storage policy constraints are explicitly called out (for example immutable storage policies must not be present; blob versioning constraints).
Reliability / troubleshooting
- Community reports of sessions reaching Bastion but failing to connect to the VM, with limited diagnostic clarity.
Security incidents (historical)
- Public reporting (June 2023) described XSS-related vulnerabilities involving Azure Bastion and other Azure services; while likely remediated, it is relevant for risk reviews and reinforces the need for defense-in-depth.

Deal disqualifiers (poor fit)

Very small environments with infrequent access where recurring always-on costs dominate.
Requirements for strong MFA/Conditional Access controls for “shareable link” access patterns that the organization cannot otherwise compensate for.
Multi-cloud or on-prem interactive access needs beyond Azure VMs (Bastion is designed for Azure VNets).

03Field reports

Review-platform sentiment (G2)

Positive themes (examples)
- Ease of access and convenience
  - G2 reviewer (Software Engineer, 6/22/2022): “it’s very simple to use… only use my browser to connect a VM… helpful since I work from home.”
- Security and reduced exposure
  - Multiple G2 reviews emphasize secure RDP/SSH without public IPs.
Negative themes / criticisms (examples)
- Documentation and learning curve
  - Same G2 reviewer notes: “The documents is a little bit impractical so it takes me some time to understand it…”
- Complexity and pricing
  - G2 reviewer (Sr. Technical specialist, 6/25/2022) states: “I feel it is bit of complex on operation. Pricing also can [be] simplified further…”
- Portal dependency
  - G2 reviewer (Founder, 6/17/2022): “We need this out of Azure Portal. We can use it only in Azure Portal.”

Gartner Peer Insights (access limitations)

Gartner Peer Insights page for Azure Bastion was accessible for high-level product/pricing description, but detailed individual review quotes were not captured in the tool output.
Gartner’s listing describes Bastion as enabling secure remote connectivity to VMs without exposing them via public IPs, supporting centralized auditing, and using a consumption-based pricing model with usage-based components.

Community discussions (Reddit) — common themes and quotes

Positive / “does what it promises”
- Reddit user reported: “Been using Bastion since [it] went into public preview, it does exactly what it promises! Secure access via the Azure Portal so you can enable MFA, no need for VPN’s, and easy to set up.”
Pricing shock and confusion (frequent)
- Reddit threads repeatedly describe Bastion as “crazy expensive” for learning/testing or small environments.
- Example (Azure subreddit): “Just got my first bill for Azure… Bastion bill was much higher than expected.”
- Another user: “I deployed Azure Bastion… I noticed a large portion of my usage was Bastion.”
Shareable links and MFA / Conditional Access concerns
- Multiple threads indicate buyers want “shareable link” access for third parties but are concerned about lack of MFA/Conditional Access behavior in that mode.
- Example: “Ideally we don’t want the 3rd parties to log into our Azure portal… shareable links… doesn’t seem to be a secure way as there is no MFA.”
Reliability / troubleshooting pain
- Recent thread (“Bastion Failures”, 2026) describes sessions reaching Bastion but failing to reach the VM, with limited visibility into what’s wrong: “azure networking is a black box.”

Why some customers consider leaving / avoiding (churn drivers)

Ongoing cost when left provisioned continuously, especially for small environments.
Security/governance concerns around shareable links (MFA/CA expectations).
Feature gaps depending on SKU (advanced features in Premium; limitations around native client/session recording interplay).

Vendor/official case studies

The Azure Bastion product pages include “customer stories/cases” sections, but the accessible snippets in this research set did not include detailed, independently verifiable ROI numbers.

What can be stated from official documentation (not ROI)

Microsoft describes Bastion as reducing exposure to port scanning and brute-force attacks by removing the VM public IP requirement for RDP/SSH.

Critical evaluation / gaps

Quantified ROI claims specific to Azure Bastion (time saved, breach reduction, cost savings versus jumpboxes) were not found with clear methodology in the sources captured.
Where security outcomes are claimed (for example “protect from threats”), they should be treated as plausible benefits rather than guaranteed measurable results without an organization-specific risk model.

04Best fit

Company sizes

Well suited for: mid-market to enterprise teams with dedicated cloud/network/security ownership — typically organizations rather than single-person projects — that require standardized access and auditing.
Less ideal for solo learners or hobbyists due to recurring provisioning costs that can be disproportionate for very small, infrequent-use scenarios.

Industries

Any regulated or security-sensitive industry running workloads on Azure (examples include financial services, healthcare, public sector, and SaaS) where eliminating public management ports is a priority.

Roles and personas

Decision makers: cloud platform owners, security leadership, network engineering leads.
End users: SREs, sysadmins, DevOps engineers, incident responders.

Pain points addressed

Removing public RDP/SSH exposure.
Reducing the need to maintain jumpbox VMs.
Centralizing access controls via Azure RBAC.

Qualification criteria (well suited)

Azure-first footprint with many VMs where standardized administrative access is required.
Organizations willing to pay for managed convenience and reduced operational burden.
Need for session recording and auditing (Premium SKU) and willingness to manage supporting storage securely.

05The pitch

What the product does (core value proposition in objective terms)

Azure Bastion is a fully managed jump host (PaaS) that provides RDP and SSH connectivity to Azure virtual machines without requiring public IP addresses on the VMs and without opening inbound RDP/SSH from the internet.
Connections are initiated from the Azure Portal (browser-based) and, depending on SKU/features, can also be initiated via native RDP/SSH clients for some scenarios.

Target market and market positioning

Target users: Azure administrators, cloud/network/security engineers, and platform teams who need interactive VM access for operations and troubleshooting.
Positioning: a managed alternative to self-managed bastion/jumpbox VMs and (in some designs) an alternative to requiring VPN for administrative access.

Azure Bastion

01Common complaints

Deal disqualifiers (poor fit)

02Why they buy

Why customers chose Azure Bastion over alternatives (as implied by reviews)

03Field reports

Review-platform sentiment (G2)

Gartner Peer Insights (access limitations)

Community discussions (Reddit) — common themes and quotes

Why some customers consider leaving / avoiding (churn drivers)

Vendor/official case studies

What can be stated from official documentation (not ROI)

Critical evaluation / gaps

04Best fit

Company sizes

Industries

Roles and personas

Pain points addressed

Qualification criteria (well suited)

05The pitch

What the product does (core value proposition in objective terms)

Target market and market positioning

01Common complaints

Deal disqualifiers (poor fit)

02Why they buy

Why customers chose Azure Bastion over alternatives (as implied by reviews)

03Field reports

Review-platform sentiment (G2)

Gartner Peer Insights (access limitations)

Community discussions (Reddit) — common themes and quotes

Why some customers consider leaving / avoiding (churn drivers)

Vendor/official case studies

What can be stated from official documentation (not ROI)

Critical evaluation / gaps

04Best fit

Company sizes

Industries

Roles and personas

Pain points addressed

Qualification criteria (well suited)

05The pitch

What the product does (core value proposition in objective terms)

Target market and market positioning