4.1.6. Azure Bastion
💡 First Principle: Azure Bastion provides secure RDP and SSH connectivity to virtual machines directly through the Azure portal, over TLS, without ever exposing a public IP address on the VM itself — eliminating the most common attack surface for VM compromise (an internet-facing RDP/SSH port) while still letting administrators manage the VM remotely.
Traditionally, remote VM management meant exposing RDP (port 3389) or SSH (port 22) to the internet, an enormously popular brute-force attack target. Bastion is a fully managed PaaS service — Microsoft operates and patches it — deployed once per VNet, removing the need for a self-managed jump box or any public-facing management port on individual VMs.
⚠️ Exam Trap: Azure Bastion is a managed platform service, not a virtual machine you deploy and patch yourself — there's no "bastion host" server for the customer to maintain.
Reflection Question: Why does removing a public IP address from a VM's RDP/SSH port meaningfully reduce its attack surface, even if strong passwords and MFA are already in place?
