Skip to content

Commit 4e279d6

Browse files
denreadenrea
authored
Merge pull request #312604 from AbdullahBell/bastion-entra-id-auth
New article: Configure Microsoft Entra ID authentication for Azure Bastion
2 parents b93eb02 + c9cbdee commit 4e279d6

2 files changed

Lines changed: 254 additions & 0 deletions

File tree

‎articles/bastion/TOC.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@
3333
items:
3434
- name: Configure Kerberos authentication
3535
href: kerberos-authentication-portal.md
36+
- name: Configure Microsoft Entra ID authentication
37+
href: bastion-entra-id-authentication.md
3638
- name: Connect to a virtual machine
3739
items:
3840
- name: Windows VM

‎articles/bastion/bastion-entra-id-authentication.md‎

Lines changed: 252 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,252 @@
1+
---
2+
title: 'Configure Microsoft Entra ID authentication'
3+
titleSuffix: Azure Bastion
4+
description: Learn how to configure Microsoft Entra ID authentication for RDP and SSH connections through Azure Bastion, including role assignments, virtual machine extensions, and connection steps.
5+
author: abell
6+
ms.service: azure-bastion
7+
ms.topic: how-to
8+
ms.date: 03/09/2026
9+
ms.author: abell
10+
11+
# Customer intent: "As a cloud administrator, I want to configure Microsoft Entra ID authentication with Azure Bastion, so that I can use identity-based access policies and MFA for my virtual machines."
12+
---
13+
14+
# Configure Microsoft Entra ID authentication for Azure Bastion
15+
16+
<a name="entra-id"></a>
17+
18+
<a name="microsoft-entra-id-authentication-preview"></a>
19+
20+
Microsoft Entra ID authentication for [Azure Bastion](bastion-overview.md) lets you sign in to your virtual machines using your organizational identity instead of local virtual machine credentials. With Entra ID authentication, you can enforce [multifactor authentication (MFA)](/entra/identity/authentication/concept-mfa-howitworks), apply [conditional access policies](/entra/identity/conditional-access/overview), and centralize identity management across your Azure virtual machines.
21+
22+
> [!NOTE]
23+
> Microsoft Entra ID authentication for **RDP** connections in the portal is in **public preview**. Microsoft Entra ID authentication for **SSH** connections in the portal is **generally available**.
24+
25+
## Prerequisites
26+
27+
Before you configure Entra ID authentication, verify the following:
28+
29+
* **Azure Bastion host:** A Bastion host deployed in the virtual network where the virtual machine is located, or in a [peered virtual network](vnet-peering.md). The minimum SKU depends on the connection method:
30+
31+
| Connection method | Minimum SKU |
32+
|---|---|
33+
| Azure portal (RDP or SSH) | Basic |
34+
| Native client (RDP with `--enable-mfa`) | Standard |
35+
| Native client (SSH with `--auth-type AAD`) | Standard |
36+
37+
* **Supported operating systems:**
38+
* **Windows virtual machines (RDP):** Windows 10 version 20H2 or later, Windows 11 21H2 or later, or Windows Server 2022 or later.
39+
* **Linux virtual machines (SSH):** Any Linux distribution that supports the AADSSHLoginForLinux extension.
40+
41+
* **Native client connections:** Azure CLI version 2.32 or later. Run `az extension add --name ssh` to install the SSH extension. For setup details, see [Configure Bastion for native client connections](native-client.md).
42+
43+
44+
## Entra ID authentication overview
45+
46+
Entra ID authentication supports both RDP and SSH connections. The authentication flow works as follows:
47+
48+
1. You initiate a connection to a virtual machine through Azure Bastion.
49+
1. Bastion redirects you to Microsoft Entra ID for authentication, where MFA and conditional access policies are evaluated.
50+
1. After successful authentication, Bastion brokers the connection to the target virtual machine.
51+
1. The virtual machine-level extension (**AADLoginForWindows** or **AADSSHLoginForLinux**) validates the Entra ID token and grants access based on your assigned role.
52+
53+
Entra ID authentication is available through two connection methods:
54+
55+
* **Azure portal:** Connect directly from the Azure portal using RDP (Windows virtual machines) or SSH (Linux virtual machines). The [Basic SKU](bastion-sku-comparison.md) or higher is required.
56+
* **[Native client](native-client.md)"** Connect using the Azure CLI from your local computer with the [`az network bastion rdp`](/cli/azure/network/bastion#az-network-bastion-rdp) or [`az network bastion ssh`](/cli/azure/network/bastion#az-network-bastion-ssh) command. The [Standard SKU](bastion-sku-comparison.md) or higher is required.
57+
58+
When all requirements are met, Microsoft Entra ID appears as the default authentication option on the Bastion connection page in the Azure portal. If any requirement isn't met, the option doesn't appear.
59+
60+
> [!NOTE]
61+
> The sign-in experience differs between connection methods. Portal connections use passwordless authentication—you sign in with your Entra ID credentials and don't need a local VM password. Native client RDP connections prompt for password entry after MFA completes. For more information, see [Sign in using password/passwordless authentication with Microsoft Entra ID](/entra/identity/devices/howto-vm-sign-in-azure-ad-windows#sign-in-using-passwordpasswordless-authentication-with-microsoft-entra-id).
62+
63+
## Assign roles
64+
65+
Users connecting with Entra ID authentication need **one of** the following role assignments:
66+
67+
* **[Virtual Machine Administrator Login:](/azure/role-based-access-control/built-in-roles#virtual-machine-administrator-login)** Grants administrator-level access to the virtual machine.
68+
* **[Virtual Machine User Login:](/azure/role-based-access-control/built-in-roles#virtual-machine-user-login)** Grants regular user-level access to the virtual machine.
69+
70+
The following [Reader](/azure/role-based-access-control/built-in-roles#reader) role assignments on the relevant resources are also required:
71+
72+
* Reader role on the virtual machine.
73+
* Reader role on the NIC with private IP of the virtual machine.
74+
* Reader role on the Azure Bastion resource.
75+
* Reader role on the virtual network of the target virtual machine (if the Bastion deployment is in a peered virtual network).
76+
77+
You can assign roles at the virtual machine, resource group, or subscription scope.
78+
79+
### [Portal](#tab/portal)
80+
81+
Follow these steps to assign the required roles using the Azure portal:
82+
83+
1. In the [Azure portal](https://portal.azure.com), navigate to the virtual machine you want to configure.
84+
1. Select **Access control (IAM)** from the left menu.
85+
1. Select **Add** > **Add role assignment**.
86+
1. On the **Role** tab, search for and select **Virtual Machine Administrator Login** (or **Virtual Machine User Login** for standard access). Select **Next**.
87+
1. On the **Members** tab, select **+ Select members**, search for the user or group, select them, and choose **Select**.
88+
1. Select **Review + assign** to complete the role assignment.
89+
1. Repeat the previous steps to assign the required Reader roles on the virtual machine, NIC, Bastion resource, and virtual network.
90+
91+
### [Azure CLI](#tab/cli)
92+
93+
Assign the **Virtual Machine Administrator Login** role at the virtual machine scope:
94+
95+
```azurecli
96+
az role assignment create \
97+
--assignee "<UserPrincipalNameOrObjectId>" \
98+
--role "Virtual Machine Administrator Login" \
99+
--scope "/subscriptions/<SubscriptionId>/resourceGroups/<ResourceGroupName>/providers/Microsoft.Compute/virtualMachines/<VMName>"
100+
```
101+
102+
To assign **Virtual Machine User Login** instead, replace the `--role` value:
103+
104+
```azurecli
105+
az role assignment create \
106+
--assignee "<UserPrincipalNameOrObjectId>" \
107+
--role "Virtual Machine User Login" \
108+
--scope "/subscriptions/<SubscriptionId>/resourceGroups/<ResourceGroupName>/providers/Microsoft.Compute/virtualMachines/<VMName>"
109+
```
110+
111+
Assign the required Reader roles. For example, the Reader role on the Bastion resource:
112+
113+
```azurecli
114+
az role assignment create \
115+
--assignee "<UserPrincipalNameOrObjectId>" \
116+
--role "Reader" \
117+
--scope "/subscriptions/<SubscriptionId>/resourceGroups/<ResourceGroupName>/providers/Microsoft.Network/bastionHosts/<BastionName>"
118+
```
119+
120+
---
121+
122+
## Install the virtual machine extension
123+
124+
The virtual machine extension validates the Entra ID token and grants access to the virtual machine. You can enable the extension during virtual machine creation by selecting **Login with Microsoft Entra ID**, or add it to an existing virtual machine using the following steps.
125+
126+
### [Windows](#tab/windows)
127+
128+
Install the **AADLoginForWindows** extension on Windows virtual machines.
129+
130+
**Supported operating systems:** Windows 10 version 20H2 or later, Windows 11 21H2 or later, Windows Server 2022 or later.
131+
132+
#### Azure portal
133+
134+
1. In the [Azure portal](https://portal.azure.com), navigate to your Windows virtual machine.
135+
1. Select **Extensions + applications** from the left menu.
136+
1. Select **+ Add**.
137+
1. Search for **AADLoginForWindows**, select the extension, and select **Next**.
138+
1. Select **Review + create**, then select **Create** to install the extension.
139+
1. Wait for the extension to finish provisioning. Verify the status on the **Extensions + applications** page shows **Provisioning succeeded**.
140+
141+
#### Azure CLI
142+
143+
```azurecli
144+
az vm extension set \
145+
--publisher Microsoft.Azure.ActiveDirectory \
146+
--name AADLoginForWindows \
147+
--resource-group "<ResourceGroupName>" \
148+
--vm-name "<VMName>"
149+
```
150+
151+
### [Linux](#tab/linux)
152+
153+
Install the **AADSSHLoginForLinux** extension on Linux virtual machines.
154+
155+
**Supported operating systems:** Any Linux distribution that supports the AADSSHLoginForLinux extension.
156+
157+
#### Azure portal
158+
159+
1. In the [Azure portal](https://portal.azure.com), navigate to your Linux virtual machine.
160+
1. Select **Extensions + applications** from the left menu.
161+
1. Select **+ Add**.
162+
1. Search for **AADSSHLoginForLinux**, select the extension, and select **Next**.
163+
1. Select **Review + create**, then select **Create** to install the extension.
164+
1. Wait for the extension to finish provisioning. Verify the status on the **Extensions + applications** page shows **Provisioning succeeded**.
165+
166+
#### Azure CLI
167+
168+
```azurecli
169+
az vm extension set \
170+
--publisher Microsoft.Azure.ActiveDirectory \
171+
--name AADSSHLoginForLinux \
172+
--resource-group "<ResourceGroupName>" \
173+
--vm-name "<VMName>"
174+
```
175+
176+
---
177+
178+
> [!TIP]
179+
> For detailed setup guidance, see [Enable Microsoft Entra sign in for a Windows virtual machine in Azure](/entra/identity/devices/howto-vm-sign-in-azure-ad-windows) or [Enable Microsoft Entra sign in for a Linux virtual machine in Azure](/entra/identity/devices/howto-vm-sign-in-azure-ad-linux).
180+
181+
## Connect using Entra ID authentication
182+
183+
After you complete the role assignments and install the virtual machine extension, you can connect to your virtual machine using Entra ID authentication. When all requirements are met, **Microsoft Entra ID** appears as the default authentication option on the Bastion connection page in the Azure portal.
184+
185+
### [Portal: RDP (Windows)](#tab/portal-rdp)
186+
187+
Connect to a Windows virtual machine using RDP with Entra ID authentication in the Azure portal. The [Basic SKU](bastion-sku-comparison.md) or higher is required.
188+
189+
1. In the [Azure portal](https://portal.azure.com), navigate to your Windows virtual machine. Select **Connect** > **Bastion**.
190+
1. In the **Connection settings** section, set **Protocol** to **RDP**. Enter the port number if you changed it from the default of 3389.
191+
1. For **Authentication type**, select **Microsoft Entra ID (Preview)**. If this option doesn't appear, verify that the virtual machine extension is installed and the required roles are assigned.
192+
1. Select **Connect** to open the RDP connection in a new browser tab.
193+
1. When prompted, sign in with your Microsoft Entra ID credentials. Multifactor authentication (MFA) and conditional access policies are evaluated during this step.
194+
195+
> [!NOTE]
196+
> If you encounter sign-in issues, see [Troubleshoot Microsoft Entra sign-in problems](/entra/identity/devices/howto-vm-sign-in-azure-ad-windows#troubleshoot-sign-in-problems).
197+
198+
### [Portal: SSH (Linux)](#tab/portal-ssh)
199+
200+
Connect to a Linux virtual machine using SSH with Entra ID authentication in the Azure portal. The [Basic SKU](bastion-sku-comparison.md) or higher is required.
201+
202+
1. In the [Azure portal](https://portal.azure.com), navigate to your Linux virtual machine. Select **Connect** > **Bastion**.
203+
1. In the **Connection settings** section, set **Protocol** to **SSH**.
204+
1. For **Authentication type**, select **Microsoft Entra ID**. If this option doesn't appear, verify that the virtual machine extension is installed and the required roles are assigned.
205+
1. Select **Connect** to establish the SSH connection.
206+
207+
### [Native client: RDP](#tab/native-rdp)
208+
209+
Connect to a Windows virtual machine using the Azure CLI native client with Entra ID authentication. The [Standard SKU](bastion-sku-comparison.md) or higher is required, and Bastion must be configured for [native client support](native-client.md).
210+
211+
Run the following command to connect with Entra ID authentication using the `--enable-mfa` flag:
212+
213+
```azurecli
214+
az network bastion rdp \
215+
--name "<BastionName>" \
216+
--resource-group "<ResourceGroupName>" \
217+
--target-resource-id "<VMResourceId>" \
218+
--enable-mfa
219+
```
220+
221+
When prompted, sign in with your Microsoft Entra ID credentials.
222+
223+
### [Native client: SSH](#tab/native-ssh)
224+
225+
Connect to a Linux virtual machine using the Azure CLI native client with Entra ID authentication. The [Standard SKU](bastion-sku-comparison.md) or higher is required, and Bastion must be configured for [native client support](native-client.md).
226+
227+
Run the following command to connect using the `--auth-type "AAD"` parameter:
228+
229+
```azurecli
230+
az network bastion ssh \
231+
--name "<BastionName>" \
232+
--resource-group "<ResourceGroupName>" \
233+
--target-resource-id "<VMResourceId>" \
234+
--auth-type "AAD"
235+
```
236+
237+
---
238+
239+
## Limitations
240+
241+
* RDP and Entra ID authentication in the portal can't be used concurrently with [graphical session recording](session-recording.md).
242+
* Microsoft Entra ID authentication isn't supported for [IP-based](connect-ip-address.md) RDP or SSH connections.
243+
* Microsoft Entra ID authentication for portal connections is supported for RDP to Windows virtual machines and SSH to Linux virtual machines only.
244+
* For [native client](connect-vm-native-client-windows.md) RDP connections, remote connection to virtual machines joined to Microsoft Entra ID is allowed only from Windows 10 or later PCs that are [Microsoft Entra registered, Microsoft Entra joined, or Microsoft Entra hybrid joined](/entra/identity/devices/overview) to the *same* directory as the virtual machine.
245+
246+
## Next steps
247+
248+
* [Create an RDP connection to a Windows virtual machine](bastion-connect-vm-rdp-windows.md)
249+
* [Create an SSH connection to a Linux virtual machine](bastion-connect-vm-ssh-linux.md)
250+
* [Connect to a virtual machine using a native client](connect-vm-native-client-windows.md)
251+
* [Configure Kerberos authentication](kerberos-authentication-portal.md) for domain-joined virtual machines
252+
* [Azure Bastion FAQ](bastion-faq.md)

0 commit comments

Comments
 (0)