adjusted article and added diagram.

Author: Abdullah Bell

articles/bastion/bastion-connect-vm-ssh-linux.md

@@ -19,7 +19,7 @@ For native client connections using Azure CLI, see [Connect to a VM using a Linu
 
 The following diagram shows the dedicated deployment architecture using an SSH connection.
 
-:::image type="content" source="./media/create-host/host-architecture.png" alt-text="Diagram that shows the Azure Bastion architecture." lightbox="./media/create-host/host-architecture.png":::
+:::image type="content" source="./media/connect-vm-ssh-linux/host-architecture-ssh-linux.png" alt-text="Diagram that shows the Azure Bastion architecture." lightbox="./media/connect-vm-ssh-linux/host-architecture-ssh-linux.png":::
 
 ## Prerequisites
 
@@ -63,85 +63,17 @@ The following table shows which authentication methods are available for each co
 | SSH private key from local file | Azure portal, IP address (portal), native client | Basic (portal), Standard (IP address, native client) |
 | SSH private key from Azure Key Vault | Azure portal | Basic |
 
-## Connect to a virtual machine using SSH
-
-Choose your connection method tab below to see the navigation steps for connecting to your VM. Then, configure your authentication settings using the details in the [Authentication details](#authentication-details) section. For available authentication methods per connection method, see the [authentication methods](#authentication-methods) table.
-
-# [Azure portal](#tab/portal)
-
-Use the Azure portal to create a browser-based SSH connection to your Linux virtual machine. This method connects directly through your browser. No native SSH client or additional software is required on your local computer. The [Basic SKU](bastion-sku-comparison.md) or higher is required, or the Standard SKU if you need custom ports.
-
-1. In the [Azure portal](https://portal.azure.com), go to the virtual machine to which you want to connect. At the top of the virtual machine **Overview** page, select **Connect**, then select **Connect via Bastion** from the dropdown. This opens the **Bastion** page. You can also go to the Bastion page directly in the left pane.
-
-1. On the **Bastion** page, the settings that you can configure depend on the Bastion [SKU](bastion-overview.md#sku) that your bastion host has been configured to use.
-
-   * If you're using a SKU higher than the Basic SKU, **Connection Settings** values (ports and protocols) are visible and can be configured.
-   * If you're using the Basic SKU or Developer SKU, you can't configure **Connection Settings** values. Instead, your connection uses the following default settings: SSH and port 22.
-   * To view and select an available **Authentication Type**, use the dropdown.
-
-1. Configure your authentication settings. For configuration details, see [Authentication details](#authentication-details). Select **Connect**.
-
-# [IP address (portal)](#tab/ip-address)
-
-Use the Azure portal to create a browser-based SSH connection to your Linux virtual machine using a specified IP address. This method connects through your browser and doesn't require a native SSH client or additional software on your local computer. The Standard SKU or higher is required, and you must enable [IP-based connection](connect-ip-address.md).
-
-#### Enable IP-based connection
-
-Before you can connect using an IP address, you must enable IP-based connection on your Bastion deployment.
-
-1. In the [Azure portal](https://portal.azure.com), go to your Bastion deployment.
-
-1. On the **Configuration** page, for **Tier**, verify the SKU is set to the **Standard** SKU or higher. If the SKU is set to the Basic SKU, select a higher SKU from the dropdown.
-
-1. Select **IP based connection**.
-
-1. Select **Apply** to apply the changes. It takes a few minutes for the Bastion configuration to complete.
-
-After IP-based connection is enabled, you specify the IP address of the target virtual machine directly on the Bastion **Connect** page, rather than selecting a virtual machine from the Azure portal.
-
-#### Connect using an IP address
-
-1. To connect to a virtual machine using a specified IP address, make the connection from Bastion, not directly from the virtual machine page. On your Bastion resource, select **Connect** to open the Connect page.
-
-1. On the Bastion **Connect** page, for **IP address**, enter the IP address of the target virtual machine.
-
-1. Adjust your connection settings to the desired **Protocol** (SSH) and **Port**.
-
-1. Available authentication types for IP-based SSH connections from the portal are **Password** and **SSH Private Key from Local File**. Configure your authentication settings. For configuration details, see [Authentication details](#authentication-details). Select **Connect**.
-
-> [!NOTE]
-> Microsoft Entra ID authentication isn't supported for IP-based SSH connections. For more information, see [IP-based connections](connect-ip-address.md).
-
-# [Native client](#tab/native-client)
-
-Connect to your Linux virtual machine from a local computer using Azure CLI (`az network bastion ssh`). This method requires the [Standard SKU](bastion-sku-comparison.md) or higher with [native client support configured](native-client.md).
-
-:::image type="content" source="./media/native-client/native-client-architecture.png" alt-text="Diagram shows a connection via native client." lightbox="./media/native-client/native-client-architecture.png":::
-
-[!INCLUDE [VM connect prerequisites](../../includes/bastion-native-pre-vm-connect.md)]
-
-[!INCLUDE [roles and ports](../../includes/bastion-native-roles-ports.md)]
-
-For complete steps to connect using the native client, see [Connect to a VM using Bastion and a Linux native client](connect-vm-native-client-linux.md).
-
-For supported authentication types, see [Authentication details](#authentication-details).
-
-> [!NOTE]
-> Signing in using an SSH private key stored in Azure Key Vault isn't supported with native client connections. Before signing in to your Linux VM using an SSH key pair, download your private key to a file on your local machine.
-
----
-
 ## Authentication details
 
 Configure the authentication settings for your connection. Not all authentication methods are available for every connection method. See the [authentication methods](#authentication-methods) table for availability.
 
-### Microsoft Entra ID
+# [Microsoft Entra ID](#tab/entra-id)
 
 **Available for:** Azure portal, native client. Not supported for IP-based connections.
 
 For prerequisites, setup steps, and connection instructions, see [Configure Microsoft Entra ID authentication for Azure Bastion](bastion-entra-id-authentication.md).
 
-### Username and password
+# [Username and password](#tab/password)
 
 **Available for:** Azure portal, IP address (portal), native client.
 
@@ -155,7 +87,7 @@ To authenticate using a username and password, configure the following settings.
 
 When connecting via the portal, select **Open in new browser tab** if desired, then select **Connect**.
 
-### Password from Azure Key Vault
+# [Password from Azure Key Vault](#tab/keyvault-password)
 
 **Available for:** Azure portal only.
 
@@ -173,7 +105,7 @@ For Key Vault setup requirements, see [Key Vault configuration](#key-vault-confi
 
 Select **Open in new browser tab** if desired, then select **Connect**.
 
-### SSH private key from local file
+# [SSH private key from local file](#tab/ssh-key-local)
 
 **Available for:** Azure portal, IP address (portal), native client.
 
@@ -191,7 +123,7 @@ To authenticate using a private key from a local file, configure the following s
 
 When connecting via the portal, select **Open in new browser tab** if desired, then select **Connect**.
 
-### SSH private key from Azure Key Vault
+# [SSH private key from Azure Key Vault](#tab/ssh-key-keyvault)
 
 **Available for:** Azure portal only. Not supported for native client or IP-based connections.
 
@@ -211,14 +143,84 @@ For Key Vault setup requirements, see [Key Vault configuration](#key-vault-confi
 
 Select **Open in new browser tab** if desired, then select **Connect**.
 
-## Key Vault configuration
+---
+
+### Key Vault configuration
 
 If you're using Azure Key Vault to store a password or SSH private key, configure your Key Vault using the following requirements:
 
 * If you didn't set up an Azure Key Vault resource, see [Create a key vault](/azure/key-vault/secrets/quick-create-powershell) and store your secret (password or SSH private key) as the value of a new Key Vault secret.
 * Make sure you have **List** and **Get** access to the secrets stored in the Key Vault resource. To assign and modify access policies for your Key Vault resource, see [Assign a Key Vault access policy](/azure/key-vault/general/assign-access-policy-portal).
 * Store your secret in Azure Key Vault using the **PowerShell** or **Azure CLI** experience. Storing your secret via the Azure Key Vault portal experience interferes with the formatting and results in unsuccessful login. If you stored your private key as a secret using the portal experience and no longer have access to the original private key file, see [Update SSH key](/azure/virtual-machines/extensions/vmaccess-linux#update-ssh-key) to update access to your target VM with a new SSH key pair.
 
+## Connect to a virtual machine using SSH
+
+Choose your connection method tab below to see the navigation steps for connecting to your VM. For available authentication methods per connection method, see the [authentication methods](#authentication-methods) table.
+
+# [Azure portal](#tab/portal)
+
+Use the Azure portal to create a browser-based SSH connection to your Linux virtual machine. This method connects directly through your browser. No native SSH client or additional software is required on your local computer. The [Basic SKU](bastion-sku-comparison.md) or higher is required, or the Standard SKU if you need custom ports.
+
+1. In the [Azure portal](https://portal.azure.com), go to the virtual machine to which you want to connect. At the top of the virtual machine **Overview** page, select **Connect**, then select **Connect via Bastion** from the dropdown. This opens the **Bastion** page. You can also go to the Bastion page directly in the left pane.
+
+1. On the **Bastion** page, the settings that you can configure depend on the Bastion [SKU](bastion-overview.md#sku) that your bastion host has been configured to use.
+
+   * If you're using a SKU higher than the Basic SKU, **Connection Settings** values (ports and protocols) are visible and can be configured.
+   * If you're using the Basic SKU or Developer SKU, you can't configure **Connection Settings** values. Instead, your connection uses the following default settings: SSH and port 22.
+   * To view and select an available **Authentication Type**, use the dropdown.
+
+1. Configure your authentication settings. For details, see [Authentication details](#authentication-details). Select **Connect**.
+
+# [IP address (portal)](#tab/ip-address)
+
+Use the Azure portal to create a browser-based SSH connection to your Linux virtual machine using a specified IP address. This method connects through your browser and doesn't require a native SSH client or additional software on your local computer. The Standard SKU or higher is required, and you must enable [IP-based connection](connect-ip-address.md).
+
+#### Enable IP-based connection
+
+Before you can connect using an IP address, you must enable IP-based connection on your Bastion deployment.
+
+1. In the [Azure portal](https://portal.azure.com), go to your Bastion deployment.
+
+1. On the **Configuration** page, for **Tier**, verify the SKU is set to the **Standard** SKU or higher. If the SKU is set to the Basic SKU, select a higher SKU from the dropdown.
+
+1. Select **IP based connection**.
+
+1. Select **Apply** to apply the changes. It takes a few minutes for the Bastion configuration to complete.
+
+After IP-based connection is enabled, you specify the IP address of the target virtual machine directly on the Bastion **Connect** page, rather than selecting a virtual machine from the Azure portal.
+
+#### Connect using an IP address
+
+1. To connect to a virtual machine using a specified IP address, make the connection from Bastion, not directly from the virtual machine page. On your Bastion resource, select **Connect** to open the Connect page.
+
+1. On the Bastion **Connect** page, for **IP address**, enter the IP address of the target virtual machine.
+
+1. Adjust your connection settings to the desired **Protocol** (SSH) and **Port**.
+
+1. Available authentication types for IP-based SSH connections from the portal are **Password** and **SSH Private Key from Local File**. Configure your authentication settings. For details, see [Authentication details](#authentication-details). Select **Connect**.
+
+> [!NOTE]
+> Microsoft Entra ID authentication isn't supported for IP-based SSH connections. For more information, see [IP-based connections](connect-ip-address.md).
+
+# [Native client](#tab/native-client)
+
+Connect to your Linux virtual machine from a local computer using Azure CLI (`az network bastion ssh`). This method requires the [Standard SKU](bastion-sku-comparison.md) or higher with [native client support configured](native-client.md).
+
+:::image type="content" source="./media/native-client/native-client-architecture.png" alt-text="Diagram shows a connection via native client." lightbox="./media/native-client/native-client-architecture.png":::
+
+[!INCLUDE [VM connect prerequisites](../../includes/bastion-native-pre-vm-connect.md)]
+
+[!INCLUDE [roles and ports](../../includes/bastion-native-roles-ports.md)]
+
+For complete steps to connect using the native client, see [Connect to a VM using Bastion and a Linux native client](connect-vm-native-client-linux.md).
+
+For supported authentication types, see [Authentication details](#authentication-details).
+
+> [!NOTE]
+> Signing in using an SSH private key stored in Azure Key Vault isn't supported with native client connections. Before signing in to your Linux VM using an SSH key pair, download your private key to a file on your local machine.
+
+---
+
 ## Limitations
 
 * **IP-based connections:** IP-based connection doesn't work with force tunneling over VPN, or when a default route is advertised over an ExpressRoute circuit. Azure Bastion requires access to the internet. Force tunneling or default route advertisement results in traffic being dropped.