Skip to content
Trending
Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface
Use Shareable Link for Azure Bastion Host Connect

Use Shareable Link for Azure Bastion Host Connect

Written By Jitesh Kumar
Last Updated November 23, 2022
Posted In Azure
SHARE

Let’s learn how you can create shareable link for Azure Bastion host. The Bastion Shareable Link feature lets users connect to virtual machine or virtual machine scale set using Azure Bastion without accessing the Azure portal.

With the new Azure Bastion shareable links feature in public preview and included in Standard SKU, Shareable links is not currently supported for peered VNets that are not in the same subscription or same region.

When a user without Azure credentials clicks a shareable link, a webpage opens that prompts the user to sign in to the target resource via RDP or SSH. Users authenticate using username and password or private key, depending on what you have configured for the target resource.

The shareable link does not contain any credentials – the admin must provide sign-in credentials to the user. This feature will solve two key pain points:

Patch My PC
  • Administrators will no longer have to provide full access to their Azure accounts to one-time VM users—helping to maintain their privacy and security.
  • Users without Azure subscriptions can seamlessly connect to VMs without exposing RDP/SSH ports to the public internet.

By default, users in your org will have only read access to shared links. If a user has read access, they’ll only be able to use and view shared links, but can’t create or delete a shareable link.

Prerequisites Create Shareable Link for Azure Bastion

  • Azure Bastion is deployed to your VNet.
  • Bastion must be configured to use the Standard SKU for this feature. You can update the SKU from Basic to Standard when you configure the shareable links feature.
  • The VNet contains the VM resource to which you want to create a shareable link.

Before you can create a shareable link to a VM, you must first enable the feature. This post helps you use the Shareable Link feature to create a shareable link for an existing Azure Bastion deployment.

Connect Azure Bastion Host Using Shareable Link Fig.1
Use Shareable Link for Azure Bastion Host Connect Fig.1

On the Configuration page, for Tier, select Standard. This feature requires the Standard SKU. The Standard tier enables host scaling and customization of additional features. Once enabled, you cannot downgrade to the Basic tier.

NOTE! Shareable Link is not available for the Bastion Basic SKU. To enable the feature, upgrade to Bastion Standard, check the box and save your changes.

Select Shareable Link from the listed features to enable the Shareable Link feature. Verify that you have selected the settings that you want, then click Apply.

Connect Azure Bastion Host Using Shareable Link Fig.2
Use Shareable Link for Azure Bastion Host Connect Fig.2

Bastion will immediately begin updating the settings for your bastion host. Updates will take about 10 minutes.

Let’s check how you can create shareable links for Azure Bastion, you specify each resource for which you want to create a shareable link.

  • In the Azure portal https://portal.azure.com/, Navigate to your bastion resource.
  • On your bastion page, in the left pane, click Shareable links. Click + Add to open the Create shareable link page.
Connect Azure Bastion Host Using Shareable Link Fig.3 Credit - Microsoft
Use Shareable Link for Azure Bastion Host Connect Fig.3 Credit – Microsoft

On the Create shareable link page, select the resources for which you want to create a shareable link. You can select specific resources, or you can select all. A separate shareable link will be created for each selected resource. Click Apply to create links.

Connect Azure Bastion Host Using Shareable Link Fig.4 Credit - Microsoft
Connect Azure Bastion Host Using Shareable Link Fig.4 Credit – Microsoft

Once the links are created, you can view them on the Shareable links page. The following example shows links for multiple resources. You can see that each resource has a separate link and the link status is Active.

To share a link, copy it, then send it to the user. The link doesn’t contain authentication credentials.

Use Shareable Link for Azure Bastion Host Connect Fig.5 Credit - Microsoft
Use Shareable Link for Azure Bastion Host Connect Fig.5 Credit – Microsoft

After receiving the link, when the user opens the shareable link in their preferred browser to connect the VMs.

In the left corner, the user can select whether to see text and images copied to the clipboard. The user inputs the required information, then clicks Login to connect.

NOTE! A shared link doesn’t contain authentication credentials. The admin must provide sign-in credentials to the user. Custom port and protocols are supported.

Use Shareable Link for Azure Bastion Host Connect Fig.6 Credit - Microsoft
Use Shareable Link for Azure Bastion Host Connect Fig.6 Credit – Microsoft

Author

Written by

Jitesh has over 5 years of working experience in the IT Industry. He writes and shares his experiences related to Microsoft device management technologies and IT Infrastructure management. His primary focus area is Windows 10 Deployment solution with Configuration Manager, Microsoft Deployment Toolkit (MDT), and Microsoft Intune.

Discussion · 2 comments

  1. I tested in my lab and was able to rdp without any mfa all you need is the username and password of the VM and you are logged on. This is a horrible solution and dont know what Microsoft was thinking .

    Reply

  2. why is it a horrible solution?? its just RDP without the need of a public facing machine its actually a genius idea

    Reply

Join the discussion

Your email address will not be published. Required fields are marked *

Related guides

Azure

Azure Files Goes Cloud-Native with Entra-Only Identities and Managed Identities

Key Takeaways Managed Identity and Entra-Only identities for Azure Files help organizations build a fully cloud-native and secure storage environment by removing the need for passwords, storage account keys, on-premises Active Directory, or hybrid identity infrastructure. With native Microsoft Entra ID authentication, applications, virtual machines, and users can securely access Azure Files using identity-based authentication […]

AC Anoop C Nair 4 min read
Azure

Microsoft Dev Box Moves to Maintenance Mode as Windows 365 Takes Lead for Developer Scenarios

key Takeaways: Let’s discuss about Microsoft Dev Box Moves to Maintenance Mode as Windows 365 Takes Lead for Developer Scenarios. Microsoft announced the Maintenance mode in Dev Box, and no additional features are planned. Microsoft’s investments for developer cloud environments are focused on Windows 365, which provides a unified, scalable solution for developer scenarios. Microsoft […]

AC Anoop C Nair 3 min read
Azure

Multi-Zone Management Platform Architecture for Windows Cloud Solutions

Key Takeaways Multi-Zone Management Platform Architecture for Windows Cloud Solutions! This architecture highlights the core MicrosoftMicrosoft Azure components used to host and deliver Cloud PC services. To ensure high availability and reliability, the infrastructure is distributed across multiple availability zones within each region. This design helps protect the service from zonal outages and keeps workloads […]

AC Anoop C Nair 4 min read
Azure

How to Protect and Recover your Infrastructure with Azure Site Recovery

Key Takeaways Azure Site Recovery is a disaster-recovery service in Microsoft Azure that helps keep your applications running if a cloud region fails. Normally, your virtual machines (VMs) run in one region. ASR creates a copy of those machines in another region so that if the main region goes down, your services can continue running […]

AC Anoop C Nair 4 min read