Skip to content

Commit 231b84c

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #313046 from AbdullahBell/bastion-ssh-windows-merge-1
Overhaul Bastion SSH-to-Windows article with tabbed auth methods and accuracy fixes
2 parents 8fa0310 + adb26f1 commit 231b84c

2 files changed

Lines changed: 83 additions & 110 deletions

File tree

‎articles/bastion/bastion-connect-vm-ssh-windows.md‎

Lines changed: 83 additions & 110 deletions
Original file line numberDiff line numberDiff line change
@@ -1,168 +1,141 @@
11
---
22
title: 'Connect to a Windows VM using SSH'
33
titleSuffix: Azure Bastion
4-
description: Learn how to use Azure Bastion to connect to Windows VM using SSH.
4+
description: Learn how to use Azure Bastion to connect to a Windows VM using SSH via the Azure portal.
55
author: abell
66
ms.service: azure-bastion
77
ms.topic: how-to
8-
ms.date: 02/10/2025
8+
ms.date: 03/12/2026
99
ms.author: abell
1010
# Customer intent: "As a cloud administrator, I want to connect to a Windows VM using SSH through a secure service, so that I can manage the VM without exposing sensitive ports to the internet."
1111
---
1212

1313
# Create an SSH connection to a Windows VM using Azure Bastion
1414

15-
This article shows you how to securely and seamlessly create an SSH connection to your Windows VMs located in an Azure virtual network directly through the Azure portal. When you use Azure Bastion, your VMs don't require a client, agent, or additional software. You can also connect to a Windows VM using RDP. For information, see [Create an RDP connection to a Windows VM](bastion-connect-vm-rdp-windows.md).
15+
This article describes how to create a secure SSH connection to your Windows virtual machines using Azure Bastion. You can connect through the Azure portal (browser-based). When you use Azure Bastion, your virtual machines don't require a client, agent, or additional software. Azure Bastion securely connects to all virtual machines in the virtual network without exposing RDP/SSH ports to the public internet. For more information, see [What is Azure Bastion?](bastion-overview.md)
1616

17-
Azure Bastion provides secure connectivity to all of the VMs in the virtual network in which it's provisioned. Using Azure Bastion protects your virtual machines from exposing RDP/SSH ports to the outside world, while still providing secure access using RDP/SSH. For more information, see the [What is Azure Bastion?](bastion-overview.md)
17+
For RDP connections to a Windows virtual machine, see [Create an RDP connection to a Windows VM](bastion-connect-vm-rdp-windows.md). For native client connections using Azure CLI (including SSH tunnels), see [Connect to a VM using a native client](connect-vm-native-client-windows.md).
1818

19-
> [!NOTE]
20-
> If you want to create an SSH connection to a Windows VM, Azure Bastion must be configured using the Standard SKU or higher.
21-
>
22-
23-
When connecting to a Windows virtual machine using SSH, you can use both username/password and SSH keys for authentication.
19+
The following diagram shows the dedicated deployment architecture using an SSH connection.
2420

25-
The SSH private key must be in a format that begins with `"-----BEGIN RSA PRIVATE KEY-----"` and ends with `"-----END RSA PRIVATE KEY-----"`.
21+
:::image type="content" source="./media/connect-vm-ssh-windows/host-architecture-ssh-windows.png" alt-text="Diagram that shows the Azure Bastion architecture." lightbox="./media/connect-vm-ssh-windows/host-architecture-ssh-windows.png":::
2622

2723
## Prerequisites
2824

29-
Make sure that you have set up an Azure Bastion host for the virtual network in which the VM resides. For more information, see [Create an Azure Bastion host](quickstart-host-portal.md). Once the Bastion service is provisioned and deployed in your virtual network, you can use it to connect to any VM in this virtual network.
25+
Before you begin, verify that you meet the following criteria:
3026

31-
To SSH to a Windows virtual machine, you must also ensure that:
32-
* Your Windows virtual machine is running Windows Server 2019 or later.
33-
* You have OpenSSH Server installed and running on your Windows virtual machine. To learn how to do this, see [Install OpenSSH](/windows-server/administration/openssh/openssh_install_firstuse).
34-
* Azure Bastion has been configured to use the Standard SKU or higher.
27+
* An Azure Bastion host deployed in the virtual network where the virtual machine is located, or in a [peered virtual network](vnet-peering.md). To set up a Bastion host, see [Create a bastion host](quickstart-host-portal.md#createhost). The [Standard SKU](bastion-sku-comparison.md) or higher is required for SSH connections to Windows VMs.
3528

36-
### Required roles
29+
| Connection method | Minimum SKU | Additional configuration |
30+
|---|---|---|
31+
| Azure portal (browser) | Standard | None |
3732

38-
In order to make a connection, the following roles are required:
33+
* A Windows virtual machine running Windows Server 2019 or later in the virtual network.
3934

40-
* Reader role on the virtual machine
41-
* Reader role on the NIC with private IP of the virtual machine
42-
* Reader role on the Azure Bastion resource
43-
* Reader role on the virtual network of the target virtual machine (if the Bastion deployment is in a peered virtual network).
35+
* [OpenSSH Server](/windows-server/administration/openssh/openssh_install_firstuse) installed and running on your Windows virtual machine. Azure Bastion only supports connecting to Windows VMs via SSH using **OpenSSH**.
4436

45-
### Ports
37+
* Azure Bastion uses SSH port 22 by default. Custom ports require the [Standard SKU or higher](bastion-sku-comparison.md).
4638

47-
In order to connect to the Windows VM via SSH, you must have the following ports open on your VM:
39+
* **Required roles:**
4840

49-
* Inbound port: SSH (22) *or*
50-
* Inbound port: Custom value (you'll then need to specify this custom port when you connect to the VM via Azure Bastion)
41+
* Reader role on the virtual machine.
42+
* Reader role on the NIC with the IP of the virtual machine.
43+
* Reader role on the Azure Bastion resource.
44+
* Reader role on the virtual network of the target virtual machine (if the Bastion deployment is in a peered virtual network).
5145

5246
See the [Azure Bastion FAQ](bastion-faq.md) for additional requirements.
5347

54-
### Supported configurations
55-
56-
Currently, Azure Bastion only supports connecting to Windows VMs via SSH using **OpenSSH**.
57-
58-
## Bastion connection page
59-
60-
1. In the [Azure portal](https://portal.azure.com), go to the virtual machine that you want to connect to. On the **Overview** page, select **Connect**, then select **Bastion** from the dropdown to open the Bastion connection page. You can also select **Bastion** from the left pane.
61-
62-
1. On the **Bastion** connection page, click the **Connection Settings** arrow to expand all the available settings. Notice that if you're using the Bastion **Standard** SKU or higher, you have more available settings.
63-
64-
1. Authenticate and connect using one of the methods in the following sections.
65-
66-
* [Username and password](#username-and-password)
67-
* [Private key from local file](#private-key-from-local-file)
68-
* [Password - Azure Key Vault](#password---azure-key-vault)
69-
* [Private key - Azure Key Vault](#private-key---azure-key-vault)
48+
## Authentication methods
7049

71-
## Username and password
50+
The following authentication methods are available for SSH connections to Windows VMs through Azure Bastion. Select an authentication method tab to see the corresponding steps.
7251

73-
Use the following steps to authenticate using username and password.
52+
| Authentication method | Minimum SKU |
53+
|---|---|
54+
| Username and password | Standard |
55+
| SSH private key from local file | Standard |
56+
| Password from Azure Key Vault | Standard |
57+
| SSH private key from Azure Key Vault | Standard |
7458

59+
> [!NOTE]
60+
> [Microsoft Entra ID authentication](bastion-entra-id-authentication.md) and [Kerberos authentication](kerberos-authentication-portal.md) are not supported for SSH connections to Windows VMs. These authentication methods are available for [RDP connections](bastion-connect-vm-rdp-windows.md).
7561
76-
1. To authenticate using a username and password, configure the following settings:
77-
78-
| Setting | Value |
79-
|----------------------|-----------------------------------------------------------------------|
80-
| **Protocol** | Select SSH |
81-
| **Port** | Input the port number. Custom port connections are available for the Standard SKU or higher. |
82-
| **Authentication type** | Select **Password** from the dropdown |
83-
| **Username** | Enter the username |
84-
| **Password** | Enter the **Password** |
85-
86-
1. To work with the VM in a new browser tab, select **Open in new browser tab**.
87-
88-
1. Click **Connect** to connect to the VM.
89-
90-
## Private key from local file
91-
92-
Use the following steps to authenticate using an SSH private key from a local file.
62+
## Connect to a virtual machine using SSH
9363

94-
1. To authenticate using a private key from a local file, configure the following settings:
64+
1. In the [Azure portal](https://portal.azure.com), select your virtual machine. On the left pane, select **Connect**, then select **Bastion**.
9565

96-
| Setting | Value |
97-
|----------------------|-----------------------------------------------------------------------|
98-
| **Protocol** | Select SSH |
99-
| **Port** | Input the port number. Custom port connections are available for the Standard SKU or higher. |
100-
| **Authentication type** | Select **SSH Private Key from Local File** from the dropdown |
101-
| **Local File** | Select the local file |
102-
| **SSH Passphrase** | Enter the SSH passphrase if necessary |
66+
1. In the **Connection Settings**, select **SSH** as the protocol, and enter the port number if you changed it from the default of 22.
10367

104-
1. To work with the VM in a new browser tab, select **Open in new browser tab**.
68+
1. Select your authentication method and configure the settings shown in the corresponding tab. Then select **Connect** to open the SSH connection to your virtual machine in a new browser tab.
10569

106-
1. Click **Connect** to connect to the VM.
70+
# [Username and password](#tab/password)
10771

108-
## Password - Azure Key Vault
72+
To authenticate using a username and password, configure the following settings:
10973

110-
Use the following steps to authenticate using a password from Azure Key Vault.
74+
| Setting | Value |
75+
|---|---|
76+
| **Authentication type** | Select **Password** from the dropdown. |
77+
| **Username** | Enter the username. |
78+
| **Password** | Enter the password. |
11179

112-
1. To authenticate using a password from Azure Key Vault, configure the following settings:
80+
# [Private key from local file](#tab/local-key)
11381

114-
| Setting | Value |
115-
|------------------------|-----------------------------------------------------------------------|
116-
| **Protocol** | Select SSH |
117-
| **Port** | Input the port number. Custom port connections are available for the Standard SKU or higher. |
118-
| **Authentication type**| Select **Password from Azure Key Vault** from the dropdown |
119-
| **Username** | Enter the username |
120-
| **Subscription** | Select the subscription |
121-
| **Azure Key Vault** | Select the Key Vault |
122-
| **Azure Key Vault Secret** | Select the Key Vault secret containing the value of your SSH private key |
82+
To authenticate using an SSH private key from a local file, configure the following settings:
12383

124-
* If you didn’t set up an Azure Key Vault resource, see [Create a key vault](/azure/key-vault/secrets/quick-create-powershell) and store your SSH private key as the value of a new Key Vault secret.
84+
| Setting | Value |
85+
|---|---|
86+
| **Authentication type** | Select **SSH Private Key from Local File** from the dropdown. |
87+
| **Username** | Enter the username. |
88+
| **Local File** | Select the local file. |
89+
| **SSH Passphrase** | Enter the SSH passphrase if necessary. |
12590

126-
* Make sure you have **List** and **Get** access to the secrets stored in the Key Vault resource. To assign and modify access policies for your Key Vault resource, see [Assign a Key Vault access policy](/azure/key-vault/general/assign-access-policy-portal).
91+
# [Password - Azure Key Vault](#tab/kv-password)
12792

128-
> [!NOTE]
129-
> Please store your SSH private key as a secret in Azure Key Vault using the **PowerShell** or **Azure CLI** experience. Storing your private key via the Azure Key Vault portal experience will interfere with the formatting and result in unsuccessful login. If you did store your private key as a secret using the portal experience and no longer have access to the original private key file, see [Update SSH key](/azure/virtual-machines/extensions/vmaccess-linux#update-ssh-key) to update access to your target VM with a new SSH key pair.
130-
>
93+
To authenticate using a password from Azure Key Vault, configure the following settings:
13194

132-
1. To work with the VM in a new browser tab, select **Open in new browser tab**.
95+
| Setting | Value |
96+
|---|---|
97+
| **Authentication type** | Select **Password from Azure Key Vault** from the dropdown. |
98+
| **Username** | Enter the username. |
99+
| **Subscription** | Select the subscription. |
100+
| **Azure Key Vault** | Select the Key Vault. |
101+
| **Azure Key Vault Secret** | Select the Key Vault secret containing the value of your password. |
133102

134-
1. Click **Connect** to connect to the VM.
103+
If you didn't set up an Azure Key Vault resource, see [Create a key vault](/azure/key-vault/secrets/quick-create-powershell) and store your password as the value of a new Key Vault secret.
135104

136-
## Private key - Azure Key Vault
105+
Make sure you have **List** and **Get** access to the secrets stored in the Key Vault resource. To assign and modify access policies for your Key Vault resource, see [Assign a Key Vault access policy](/azure/key-vault/general/assign-access-policy-portal).
137106

138-
Use the following steps to authenticate using a private key stored in Azure Key Vault.
107+
# [Private key - Azure Key Vault](#tab/kv-key)
139108

109+
To authenticate using a private key stored in Azure Key Vault, configure the following settings:
140110

141-
1. To authenticate using a private key stored in Azure Key Vault, configure the following settings:
111+
| Setting | Value |
112+
|---|---|
113+
| **Authentication type** | Select **SSH Private Key from Azure Key Vault** from the dropdown. |
114+
| **Username** | Enter the username. |
115+
| **Subscription** | Select the subscription. |
116+
| **Azure Key Vault** | Select the Key Vault. |
117+
| **Azure Key Vault Secret** | Select the Key Vault secret containing the value of your SSH private key. |
142118

143-
| Setting | Value |
144-
|------------------------|-----------------------------------------------------------------------|
145-
| **Protocol** | Select SSH |
146-
| **Port** | Input the port number. Custom port connections are available for the Standard SKU or higher. |
147-
| **Authentication type**| Select **SSH Private Key from Azure Key Vault** from the dropdown |
148-
| **Username** | Enter the username |
149-
| **Subscription** | Select the subscription |
150-
| **Azure Key Vault** | Select the Key Vault |
151-
| **Azure Key Vault Secret** | Select the Key Vault secret containing the value of your SSH private key |
152-
119+
If you didn't set up an Azure Key Vault resource, see [Create a key vault](/azure/key-vault/secrets/quick-create-powershell) and store your SSH private key as the value of a new Key Vault secret.
153120

154-
* If you didn’t set up an Azure Key Vault resource, see [Create a key vault](/azure/key-vault/secrets/quick-create-powershell) and store your SSH private key as the value of a new Key Vault secret.
121+
Make sure you have **List** and **Get** access to the secrets stored in the Key Vault resource. To assign and modify access policies for your Key Vault resource, see [Assign a Key Vault access policy](/azure/key-vault/general/assign-access-policy-portal).
155122

156-
* Make sure you have **List** and **Get** access to the secrets stored in the Key Vault resource. To assign and modify access policies for your Key Vault resource, see [Assign a Key Vault access policy](/azure/key-vault/general/assign-access-policy-portal).
123+
> [!NOTE]
124+
> Store your SSH private key as a secret in Azure Key Vault using the **PowerShell** or **Azure CLI** experience. Storing your private key via the Azure Key Vault portal experience will interfere with the formatting and result in unsuccessful login. If you did store your private key as a secret using the portal experience and no longer have access to the original private key file, see [Update SSH key](/azure/virtual-machines/extensions/vmaccess-linux#update-ssh-key) to update access to your target VM with a new SSH key pair.
157125
158-
> [!NOTE]
159-
> Please store your SSH private key as a secret in Azure Key Vault using the **PowerShell** or **Azure CLI** experience. Storing your private key via the Azure Key Vault portal experience will interfere with the formatting and result in unsuccessful login. If you did store your private key as a secret using the portal experience and no longer have access to the original private key file, see [Update SSH key](/azure/virtual-machines/extensions/vmaccess-linux#update-ssh-key) to update access to your target VM with a new SSH key pair.
160-
>
126+
---
161127

162-
1. To work with the VM in a new browser tab, select **Open in new browser tab**.
128+
## Limitations
163129

164-
1. Click **Connect** to connect to the VM.
130+
* **Connection methods:** SSH connections to Windows VMs are supported through the Azure portal only. Native client (`az network bastion ssh`) and IP-based connections aren't supported for SSH to Windows VMs. For a workaround using RDP over port 22, see [Connect to a VM using a native client](connect-vm-native-client-windows.md).
131+
* **Microsoft Entra ID:** Microsoft Entra authentication isn't supported for SSH connections to Windows VMs. For Entra ID auth details, see [About Microsoft Entra ID authentication](bastion-entra-id-authentication.md).
132+
* **Kerberos:** Kerberos authentication isn't supported for SSH connections. For Kerberos with RDP connections, see [Configure Kerberos authentication](kerberos-authentication-portal.md).
133+
* **File transfer:** File transfer isn't available for SSH connections via the portal. To transfer files, use a [native client RDP connection](vm-upload-download-native.md).
134+
* **Key format:** SSH private keys must be in RSA format (`-----BEGIN RSA PRIVATE KEY-----`).
165135

166136
## Next steps
167137

168-
For more information about Azure Bastion, see the [Bastion FAQ](bastion-faq.md).
138+
* [Connect to a Windows VM using RDP](bastion-connect-vm-rdp-windows.md)
139+
* [What is Azure Bastion?](bastion-overview.md)
140+
* [Connect to a VM using a native client](connect-vm-native-client-windows.md)
141+
* [Azure Bastion FAQ](bastion-faq.md)

‎articles/bastion/media/connect-vm-ssh-windows/host-architecture-ssh-windows.png‎

47.2 KB
Loading

0 commit comments

Comments
 (0)