Topic 2 of 8
Azure Bastion and Azure Key Vault
Two services that close classic gaps: Bastion avoids exposing VM management ports to the internet, and Key Vault keeps secrets, keys, and certificates out of code. Both apply least privilege and shrink the attack surface.
Contents
The problem with exposed RDP and SSH
Picture several virtual networks protected with NSGs and Azure Firewall. You're protected from the outside, but your developers and data scientists, who work remotely, need direct access to the VMs.
In the traditional model you'd have to expose the RDP (Remote Desktop Protocol) or SSH (Secure Shell) ports to the internet. Attackers actively hunt for machines with open management ports, and a compromised VM becomes the entry point to attack the rest of the environment.
What is Azure Bastion?
A fully platform-managed PaaS service provisioned inside the virtual network that provides secure RDP and SSH connectivity to VMs directly from the Azure portal, using TLS. VMs don't need a public IP, an agent, or special client software.
The user opens the VM in the Azure portal
They choose to connect with Bastion.
An HTML5 web client opens
It's streamed to their device over TLS on port 443, which traverses corporate firewalls.
Bastion opens the RDP/SSH session
To the VM's private IP, inside the virtual network.
Bastion is deployed per virtual network, not per subscription, account, or VM. Once provisioned, the RDP/SSH experience is available to every VM in that virtual network and in peered networks.
Bastion benefits
RDP and SSH in the portal
A direct session from the Azure portal with a single click.
TLS and firewall traversal
The session is encrypted with TLS and traverses corporate firewalls.
No public IP on the VM
The connection uses the VM's private IP.
No NSGs to manage
It's an internally hardened PaaS; you don't need to apply NSGs on its subnet.
Protection against port scanning
VMs aren't exposed to the internet, so nobody outside the network can scan them.
Hardening in one place
Bastion sits at the network perimeter and Azure keeps it up to date against zero-day exploits, instead of hardening every VM.
Another way to reduce management port exposure is just-in-time VM access in Defender for Cloud plans, which opens the ports only when needed.
Tiers and connection methods
| Tier | Features | For |
|---|---|---|
| Developer | Shared infrastructure, no cost, one connection at a time, in select regions | Dev and test, not production |
| Basic | Dedicated fixed-capacity deployment with core capabilities | Production with moderate needs |
| Standard | Everything in Basic plus host scaling, shareable links, IP-based connection, custom ports, native client, and file transfer | Organizations that need flexibility |
| Premium | Everything in Standard plus session recording and private-only deployment, with no public IP | Strict regulatory or compliance requirements |
Browser
HTML5 web client from the portal, no extra software. All tiers.
Native client
The SSH or RDP client installed on the local computer. Standard and Premium.
Shareable links
Let authorized users connect without going into the portal. Standard and Premium.
In every case, traffic goes over TLS on port 443, so no extra ports need to be opened on corporate firewalls.
What is Azure Key Vault?
A cloud service for securely storing and accessing secrets: anything whose access you want to tightly control, such as API keys, passwords, certificates, or cryptographic keys.
Secrets management
Store and tightly control access to tokens, passwords, certificates, and API keys.
Key management
Create and control the encryption keys that protect your data.
Certificate management
Provision, manage, and deploy public and private TLS/SSL certificates for Azure and connected resources.
Why use Key Vault
Centralize application secrets
You control their distribution and greatly reduce the risk of leaking them by accident. Developers no longer store security information in code: the app retrieves it at runtime with a unique identifier (URI), with no extra code to protect it.
Securely store secrets and keys
Every caller, user or application, must authenticate and be authorized before getting access.
Monitor access and use
Logs of when and how secrets and keys are accessed, sent to your monitoring solution to detect unauthorized access, support audits, and investigate incidents.
Simplified administration
It replicates content within the region and to a secondary region (high availability with no admin action), is managed from the portal, and automates certificate tasks from public CAs, like enrollment and renewal.
Segregate secrets
Each application accesses only the vault it's allowed to and only certain operations. You can create one vault per application and team.
Authentication and authorization
Authentication
With Microsoft Entra ID, which establishes each caller's identity.
Authorization
With Azure RBAC or Key Vault access policies, which decide which operations it can perform.
Key Vault and Zero Trust
It directly supports the least privilege principle: each app and user accesses only the specific secrets it needs, which limits the blast radius if a credential is compromised. Key Vault is also designed so that Microsoft doesn't see or extract your data.
Integrations and tiers
Azure Disk Encryption
Stores the keys that encrypt VM disks.
Azure SQL Database and SQL Server
Stores and manages the keys that protect database data.
Azure App Service
Apps read connection strings and API keys at runtime without storing them in code or configuration files.
Certificates
Provisions and automatically renews certificates from public CAs, reducing outages from expired certificates.
| Tier | Key protection | For |
|---|---|---|
| Standard | Software-based | Most business scenarios |
| Premium | HSM-protected keys: dedicated, tamper-resistant hardware the keys never leave | Strict compliance requirements, such as financial services or government |
Both tiers offer the same secrets, keys, and certificates capabilities; only the hardware protection of cryptographic keys changes.
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| Remote developers must RDP into VMs with no public IP | Azure Bastion | RDP/SSH from the portal over TLS on port 443. |
| A test environment needs Bastion at no cost | Bastion Developer | Free shared infrastructure; not for production. |
| Admin sessions must be recorded for compliance | Bastion Premium | It includes session recording. |
| Admins want to use their local SSH client | Bastion Standard or Premium | Native client connection. |
| An app stores its connection string in code | Azure Key Vault | The app reads it at runtime without exposing it. |
| Encryption keys must live in tamper-resistant hardware | Key Vault Premium | HSM-protected keys. |
| Automatically renew TLS certificates from a public CA | Key Vault (certificates) | It automates enrollment and renewal. |
| A VM must read secrets from Key Vault without credentials in code | Managed identity + Key Vault | Entra ID authenticates the VM; Key Vault authorizes it. |
Common exam traps
❓ Is Azure Bastion deployed on each VM?
No. It's deployed per virtual network and gives access to all its VMs and those in peered networks.
❓ Do VMs need a public IP to use Bastion?
No. Bastion connects to the VM's private IP.
❓ Which port does the Bastion session use?
TLS on port 443, which corporate firewalls usually allow.
❓ Which Bastion tier records sessions?
Premium, which also allows private-only deployment.
❓ Is the Developer tier fit for production?
No. It's free, shared, and meant for dev and test.
❓ What authorizes access to Key Vault?
Azure RBAC or Key Vault access policies. Entra ID handles authentication.
❓ Does Key Vault Standard offer HSM-protected keys?
No. HSM-protected keys are in the Premium tier; Standard uses software protection.
Did you get this topic?
Test what you just learned
Admins need to connect over RDP to VMs that have no public IP, without opening port 3389 to the internet. Which service do they use?
Ready to test "Azure Bastion and Azure Key Vault"?
Original questions, each with a full explanation.
Start a mock exam