Reaching VMs Privately: Bastion vs JIT vs Private-Endpoint Jumpbox
Three legitimate ways to RDP/SSH a private VM in Azure. Each trades cost for ergonomics for blast radius.
You've correctly removed public IPs from your VMs. Now your team needs to RDP or SSH them. Three patterns are common; each has a real-world trade-off.
1. Azure Bastion
- Browser-based RDP/SSH at the portal. No public IP on the VM, no client to install.
- Lives in
AzureBastionSubnetin the hub. - Cost: ~$140/month for Standard. Always-on.
- Best for: ops teams that hop into VMs daily. The convenience pays for itself.
2. Just-in-Time (JIT) VM Access
- Azure Defender for Servers feature. NSG rule to allow RDP/SSH is opened on demand for a configurable window (e.g. 1 hour).
- Caller's source IP is the only one allowed during the window.
- Audit log shows every JIT request.
- Cost: included in Defender for Servers Plan 2 (~$15/month/VM).
- Best for: rare access, high-blast-radius VMs (DC, Bastion-equivalent appliances).
3. Private-endpoint jumpbox
- Single small VM in the hub with a private IP. Reachable from on-prem via VPN/ExpressRoute.
- Or expose it via Bastion if you want to keep the no-public-IP property.
- SSH/RDP key-based, MFA via Entra-joined Windows or Linux PAM.
- Cost: just the VM. Cheapest option.
- Best for: small teams with VPN/ExpressRoute already in place.
Decision matrix
| If… | Choose |
|---|---|
| You access VMs daily and want browser convenience | Bastion |
| Access is rare and audit trail matters | JIT |
| You already have hybrid connectivity | Jumpbox |
| You want "all of the above" defense in depth | Bastion + JIT (yes, it's allowed) |
Common anti-pattern
Slapping a public IP on "just one VM" and adding it to the NSG with
SourceAddress: My Office IP. Office IPs change. SaaS scanners
discover the open port within hours. Don't.