Expert knowledge for Azure Bastion development including best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, and integrations & coding patterns. Use when configuring Bastion for AKS private clusters, VM scale sets, Entra ID auth, hub/spoke VNets, or IP-based cross-VNet access, and other Azure Bastion related development tasks. Not for Azure Virtual Network (use azure-virtual-network), Azure Virtual Network Manager (use azure-virtual-network-manager), Azure VPN Gateway (use azure-vpn-gateway), Azure Firewall (use azure-firewall).
This skill provides expert guidance for Azure Bastion. Covers best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, and integrations & coding patterns. It combines local quick-reference content with remote documentation fetching capabilities.
How to Use This Skill
IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file
IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide
This skill requires network access to fetch documentation content:
Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.
Category Index
Category
Lines
Description
Best Practices
L35-L39
Guidance on reducing Azure Bastion costs through sizing, scaling, and usage patterns while maintaining secure remote access and compliance best practices.
Decision Making
L40-L46
Guidance on choosing and upgrading Bastion SKU tiers and using IP-based Bastion connections across VNets, subscriptions, and environments.
Architecture & Design Patterns
L47-L53
Architectural options and patterns for Azure Bastion: hub/spoke and peered VNets, private-only deployments, network/topology design, and deployment guidance for secure remote access.
Limits & Quotas
L54-L58
Configuring Azure Bastion host scaling limits, including max concurrent RDP/SSH sessions, connection thresholds, and how to adjust or plan capacity for different SKUs.
Security
L59-L65
Configuring secure Azure Bastion access: Entra ID auth setup, NSG rule hardening, and applying security benchmark best practices for Bastion deployments.
Configuration
L66-L77
Configuring Bastion settings, Kerberos, monitoring/diagnostics, metrics/logs, native client access, session monitoring/recording, and shareable links for secure remote access.
Integrations & Coding Patterns
L78-L85
Using Bastion with AKS private clusters, VM scale sets, and native Windows/Linux clients, including RDP/SSH setup and file transfer workflows through Bastion.
Best Practices
Topic
URL
Optimize Azure Bastion costs without reducing security
