Comparing Azure Bastion and JIT VM Access: Use Cases and Key Benefits

The following guidance provides a quick summary of when to use Azure Bastion versus JIT VM Access based on your specific needs.

Brief Guidance:

Azure Bastion: Ideal for secure, web-based access without needing local software or public IP addresses, especially in environments with firewall restrictions.

JIT VM Access: Best for minimizing access time and costs, and when file transfers or traditional clients are required.

Use Case	Azure Bastion	JIT VM Access
Want to reduce costs for virtual machines accessible and used 24/7	✗	✓
Client computers are locked and cannot install RDP software	✓	✗
Need to transfer files	✗	✓
Corporate firewall does not have ports 3389 or 22 open	✓	✗

Architecture Explanation:

This diagram illustrates how Azure Bastion provides secure RDP/SSH access to VMs in an Azure region (Sweden). Azure Bastion, a managed PaaS service, enables connectivity via private IPs over TLS (port 443), eliminating the need to expose RDP (port 3389) or SSH (port 22) to the internet. Network Security Groups (NSGs) block direct RDP/SSH access from the internet, ensuring all traffic goes through Bastion. Azure Bastion supports VMs in multiple regions by deploying an instance per region.

Architecture Explanation:

Just-in-time (JIT) VM access, a feature of Microsoft Defender for Cloud, lets you grant temporary access to a VM for a set time, unlike Azure Bastion. Once the time’s up, access is revoked by adjusting NSG and Azure Firewall rules. Benefits include using your preferred tools (like Remote Desktop), easy file management, and automatic security by restricting inbound traffic when not in use.

Key Features and Benefits	Azure Bastion	JIT VM Access
RDP and SSH via Azure Portal	✓	✗
Remote session over TLS (port 443) and firewall traversal	✓	✗
No public IP address required on the VM	✓	✗
No hassle managing Network Security Groups (NSGs)	✓	✗
Managed PaaS service (no separate bastion host)	✓	✗
Time-limited access to reduce costs	✗	✓
Flexibility for file transfer via traditional clients	✗	✓

Note: This section covered the architecture of Azure Bastion and JIT VM Access. Configuration and troubleshooting will be explored in the next episode.