Skip to content

Commit 31aeddd

Browse files
cherylmccherylmc
committed
Managed Identity preview
1 parent dec9718 commit 31aeddd

2 files changed

Lines changed: 75 additions & 31 deletions

File tree

‎articles/bastion/session-recording.md‎

Lines changed: 74 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -2,38 +2,36 @@
22
title: 'Record Bastion sessions'
33
titleSuffix: Azure Bastion
44
description: Learn how to configure and record Bastion sessions.
5-
author: cherylmc
5+
author: aatsang
66
ms.service: azure-bastion
77
ms.topic: how-to
8-
ms.date: 01/21/2025
9-
ms.author: cherylmc
8+
ms.date: 04/10/2026
9+
ms.author: aarontsang
1010

1111
# Customer intent: As a cloud administrator, I want to configure and enable session recording for Bastion, so that I can ensure all remote sessions are captured for auditing and compliance purposes.
1212
---
13-
1413
# Configure Bastion session recording
1514

1615
This article helps you configure Bastion session recording. [!INCLUDE [Session recording](../../includes/bastion-session-recording-description.md)]
1716

18-
## Before you begin
19-
20-
The following sections outline considerations, limitations, and prerequisites for Bastion session recording.
17+
> [!NOTE]
18+
> Bastion graphical session recording supports [managed identities](/entra/identity/managed-identities-azure-resources/overview) to authenticate to your storage account, eliminating the need to manage SAS tokens. You can use either a system-assigned or user-assigned managed identity. For general information about managed identities, see [What are managed identities for Azure resources?](/entra/identity/managed-identities-azure-resources/overview).
2119
22-
**Considerations and limitations**
20+
## Considerations
2321

2422
* The Premium SKU is required for this feature.
25-
* Entra ID support for RDP sessions in portal cannot be used concurrently with graphical session recording at this time.
23+
* Entra ID support for RDP sessions in portal can't be used concurrently with graphical session recording at this time.
2624
* Session recording isn't available via native client at this time.
27-
* Immutable storage policies must not be present
25+
* Immutable storage policies must not be present.
2826
* Session recording supports one container/storage account at a time.
29-
* Changing storage containers while a session is active may cause disruptions to the session.
30-
* Blob versioning on the recordings must not be present
27+
* Changing storage containers while a session is active might cause disruptions to the session.
28+
* Blob versioning on the recordings must not be present.
3129
* When session recording is enabled on a Bastion deployment, Bastion records ALL sessions that go through the recording-enabled bastion host.
3230

33-
**Prerequisites**
31+
## Prerequisites
3432

3533
* Azure Bastion is deployed to your virtual network. See [Quickstart: Deploy Azure Bastion from the Azure portal](quickstart-host-portal.md) for steps.
36-
* Bastion must be configured to use **Premium SKU** for this feature. You can update to the Premium SKU from a lower SKU when you configure the session recording feature. To check your SKU and upgrade, if necessary, see [View or upgrade a SKU](upgrade-sku.md).
34+
* Bastion must be configured to use the **Premium SKU** for this feature. You can update to the Premium SKU from a lower SKU when you configure the session recording feature. To check your SKU and upgrade, if necessary, see [View or upgrade a SKU](upgrade-sku.md).
3735
* The virtual machine that you connect to must either be deployed to the virtual network that contains the bastion host, or to a virtual network that is directly peered to the Bastion virtual network.
3836
* To view/list the session recordings, user must have the **Storage Blob Data Reader** role.
3937

@@ -71,47 +69,92 @@ In this section, you set up and specify the container for session recordings.
7169

7270
1. Within the storage account, create a **Container**. This is the container you'll use to store your Bastion session recordings. We recommend that you create an exclusive container for session recordings. For steps, see [Create a container](../storage/blobs/storage-quickstart-blobs-portal.md#create-a-container).
7371
1. On the page for your storage account, in the left pane, expand **Settings**. Select **Resource sharing (CORS)**.
74-
1. Create a new policy under Blob service and save your changes at the top of the page.
72+
1. Create a new policy under Blob service with the following values and save your changes at the top of the page.
73+
74+
| Name | Value |
75+
| --- | --- |
76+
| Allowed origins | `https://` followed by the full DNS name of your bastion, starting with `bst-`. Keep in mind, these values are case-sensitive. |
77+
| Allowed methods | GET |
78+
| Allowed headers | * |
79+
| Exposed headers | * |
80+
| Max age | 86400 |
81+
82+
### <a name="config-storage"></a>Configure storage access and viewing recordings
83+
84+
### [Managed Service/User Identity (Recommended) - Preview](#tab/msi)
85+
86+
> [!NOTE]
87+
> The following steps are for setting up a System-assigned Managed Identity. User-assigned Identities follow similar steps.
7588
76-
| Name | Value |
77-
|---|---|
78-
|Allowed origins | `https://` followed by the full DNS name of your bastion, starting with `bst-`. Keep in mind, these values are case-sensitive. |
79-
|Allowed methods | GET|
80-
|Allowed headers |*|
81-
|Exposed headers|*|
82-
|Max age| 86400|
89+
The following steps help you configure the required settings to use managed identity. Managed identity is the recommended authentication method.
8390

91+
1. Select your Bastion resource and go to the **Identity** blade.
92+
1. Turn the Status to **On** and wait for the configuration to finish.
93+
1. Select **Azure role assignments** and select **Add role assignment (Preview)**.
8494

95+
| Scope | Subscription | Resource | Role |
96+
| --- | --- | --- | --- |
97+
| Storage | Your storage account subscription | Your storage account name | Storage Blob Data Contributor |
8598

99+
1. Select **Save** to save the role assignment.
100+
1. Go back to your Bastion resource and select **Configuration** in the left pane.
101+
1. Under **Session Recording Configuration**, select **System Assigned Managed Identity** and enter the **Blob Container URI** for your storage container.
86102

87-
## Add or update the SAS URL
103+
#### View a recording
88104

89-
To configure session recordings, you must add a SAS URL to your Bastion **Session recordings** configuration. In this section, you generate the Blob SAS URL from your container, then upload it to your bastion host.
105+
Sessions are automatically recorded when Session Recording is enabled on the bastion host. You can view recordings in the Azure portal via an integrated web player.
106+
107+
1. In the Azure portal, go to your **Bastion** host.
108+
2. In the left pane, under **Settings**, select **Session recordings**.
109+
3. Select the VM and recording link that you want to view, then select **View recording**.
110+
111+
### [SAS URL](#tab/sas)
90112

91113
The following steps help you configure the required settings directly on the **Generate SAS** page. However, you can optionally configure some of the settings by creating a stored access policy. You can then link the stored access policy to the SAS token on the **Generate SAS** page. If you want to create a stored access policy, either select Permissions and Start/expiry date and time in the access policy, or on the **Generate SAS** page.
92114

93115
1. On your storage account page, go to **Data storage -> Containers**.
94-
1. Locate the container you created to store Bastion session recordings, then click the 3 dots (ellipses) to the right of your container and select **Generate SAS** from the dropdown list.
116+
1. Locate the container you created to store Bastion session recordings, then select the 3 dots (ellipses) to the right of your container and select **Generate SAS** from the dropdown list.
95117
1. On the **Generate SAS** page, for **Permissions**, select **READ, CREATE, WRITE, LIST**.
96118
1. For **Start and expiry date/time**, use the following recommendations:
97119
* Set **Start time** to be at least 15 minutes before the present time.
98120
* Set **Expiry time** to be long into the future.
99-
1. Under **Allowed IP addresses**, please select the IP address or the IP range to accept requests from. For more information, click [here](/rest/api/storageservices/create-account-sas#specify-an-ip-address-or-ip-range)
121+
1. Under **Allowed IP addresses**, select the IP address or the IP range to accept requests from. For more information, see [Specify an IP address or IP range](/rest/api/storageservices/create-account-sas#specify-an-ip-address-or-ip-range).
100122
1. Under **Allowed Protocols**, select **HTTPS** only.
101-
1. Click **Generate SAS token and URL**. You'll see the Blob SAS token and Blob SAS URL generated at the bottom of the page.
123+
1. Select **Generate SAS token and URL**. You'll see the Blob SAS token and Blob SAS URL generated at the bottom of the page.
102124
1. Copy the **Blob SAS URL**.
103125
1. Go to your bastion host. In the left pane, select **Session recordings**.
104-
1. At the top of the page, select **Add or update SAS URL**. Paste your SAS URL, then click **Upload**.
126+
1. At the top of the page, select **Add or update SAS URL**. Paste your SAS URL, then select **Upload**.
127+
128+
#### Add or update the SAS URL
105129

106-
## View a recording
130+
The following steps help you configure the required settings directly on the **Generate SAS** page. However, you can optionally configure some of the settings by creating a stored access policy. You can then link the stored access policy to the SAS token on the **Generate SAS** page. If you want to create a stored access policy, either select Permissions and Start/expiry date and time in the access policy, or on the **Generate SAS** page.
131+
132+
1. On your storage account page, go to **Data storage -> Containers**.
133+
1. Locate the container you created to store Bastion session recordings, then select the 3 dots (ellipses) to the right of your container and select **Generate SAS** from the dropdown list.
134+
1. On the **Generate SAS** page, for **Permissions**, select **READ, CREATE, WRITE, LIST**.
135+
1. For **Start and expiry date/time**, use the following recommendations:
136+
* Set **Start time** to be at least 15 minutes before the present time.
137+
* Set **Expiry time** to be long into the future.
138+
1. Under **Allowed IP addresses**, select the IP address or the IP range to accept requests from. For more information, see [Specify an IP address or IP range](/rest/api/storageservices/create-account-sas#specify-an-ip-address-or-ip-range).
139+
1. Under **Allowed Protocols**, select **HTTPS** only.
140+
1. Select **Generate SAS token and URL**. You'll see the Blob SAS token and Blob SAS URL generated at the bottom of the page.
141+
1. Copy the **Blob SAS URL**.
142+
1. Go to your bastion host. In the left pane, select **Session recordings**.
143+
1. At the top of the page, select **Add or update SAS URL**. Paste your SAS URL, then select **Upload**.
144+
145+
#### View a recording
107146

108147
Sessions are automatically recorded when Session Recording is enabled on the bastion host. You can view recordings in the Azure portal via an integrated web player.
109148

110149
1. In the Azure portal, go to your **Bastion** host.
111150
1. In the left pane, under **Settings**, select **Session recordings**.
112-
1. The SAS URL should already be configured (earlier in this exercise). However, if your SAS URL expired, or you need to add the SAS URL, use the previous steps to acquire and upload the Blob SAS URL.
151+
1. The SAS URL should already be configured (earlier in this exercise). However, if your SAS URL expired or you need to add the SAS URL, use the previous steps to acquire and upload the Blob SAS URL.
113152
1. Select the VM and recording link that you want to view, then select **View recording**.
114153

154+
----
155+
115156
## Next steps
116157

117-
View the [Bastion FAQ](bastion-faq.md) for additional information about Bastion.
158+
* Learn about [managed identities for Azure resources](/entra/identity/managed-identities-azure-resources/overview) and how they eliminate the need to manage credentials for authenticating to Azure services.
159+
* Learn about [Azure Bastion](bastion-overview.md), a fully managed service that provides secure and seamless RDP/SSH connectivity to virtual machines without exposing RDP/SSH ports externally.
160+
* Learn about [frequently asked questions for Azure Bastion](bastion-faq.md).

‎articles/bastion/whats-new.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ You can also find the latest Bastion updates and subscribe to the RSS feed [here
2323

2424
| Type | Name | Description | Stage | Date added | Limitations |
2525
|---|---|---|---|---|---|
26+
|Feature|[Managed identity support for session recording](session-recording.md)|Managed identity support for session recording is now in public preview.|Public Preview|April 2026|N/A|
2627
|Feature|[Microsoft Entra ID support for portal (RDP)](bastion-connect-vm-rdp-windows.md#microsoft-entra-id-authentication-preview)| Microsoft Entra ID support for RDP connections in portal is now in public preview in public cloud. To learn more about Microsoft Entra ID with Azure Bastion, see [Configure Microsoft Entra ID authentication with Azure Bastion](bastion-entra-id-authentication.md). | Public Preview | November 2025 | Cannot be used concurrently with graphical session recording.|
2728
|Feature |[Connectivity to AKS private clusters](bastion-connect-to-aks-private-cluster.md)|Connect to your private AKS clusters using the tunneling command with Bastion| Public Preview |August 2025|N/A|
2829
|Feature | [Graphical session recording](session-recording.md) | Graphical session recording is now generally available in all regions that Bastion is available in. | Generally available | November 2024 | Cannot be used concurrently with native client.

0 commit comments

Comments
 (0)