A managed service that provides secure RDP and SSH connectivity to virtual machines from the Azure portal (or the native client) over TLS. VMs don't need a public IP or to expose ports 3389 or 22 to the internet.
In SC-900 it appears under Azure infrastructure security. The Basic, Standard, and Premium SKUs are deployed into a dedicated subnet named AzureBastionSubnet; the Developer SKU is a free, shared option for testing.
Azure Bastion is a concept that can show up on the exam. Check the full guide to see it in context.