Skip to content

Commit 63acef2

Browse files
JillGrant615JillGrant615
authored
Merge pull request #311639 from AbdullahBell/bastion-upgrade-sku-overhaul
Improve clarity and reduce redundancy in Bastion upgrade SKU article
2 parents 0d9dc5a + 742391a commit 63acef2

3 files changed

Lines changed: 195 additions & 30 deletions

File tree

‎articles/bastion/bastion-sku-comparison.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -128,8 +128,8 @@ Azure Bastion supports upgrading from lower SKUs to higher SKUs, but downgrading
128128

129129
### Upgrade paths
130130

131-
- **Developer to Basic/Standard/Premium**: Requires creating an AzureBastionSubnet (/26 or larger) and a public IP address (Standard SKU, Static allocation). See [Upgrade from Bastion Developer](upgrade-sku.md#upgrade-from-bastion-developer).
132-
- **Basic and Higher**: Upgrade through the Azure portal. You can add features at the same time you upgrade. See [Upgrade from Basic or Standard SKU](upgrade-sku.md#upgrade-from-the-basic-or-standard-sku).
131+
- **Developer to Basic/Standard/Premium**: Requires creating an AzureBastionSubnet (/26 or larger) and a public IP address (Standard SKU, Static allocation). See [Upgrade from Developer SKU](upgrade-sku.md#upgrade-from-developer-sku).
132+
- **Basic and Higher**: Upgrade through the Azure portal. You can add features at the same time you upgrade. See [Upgrade from Basic or Standard SKU](upgrade-sku.md#upgrade-from-basic-or-standard-sku).
133133

134134
> [!IMPORTANT]
135135
> Upgrades take approximately 10 minutes. Downgrading a SKU isn't supported. You must delete and recreate Azure Bastion. You can add features during the upgrade process.

‎articles/bastion/troubleshoot.md‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: bastion
55
author: abell
66
ms.service: azure-bastion
77
ms.topic: troubleshooting
8-
ms.date: 02/04/2026
8+
ms.date: 02/10/2026
99
ms.author: abell
1010
# Customer intent: As a network administrator, I want to troubleshoot connectivity issues in Azure Bastion so that I can ensure seamless access to my virtual machines and efficiently manage network security settings.
1111
---
@@ -27,6 +27,17 @@ This section describes common deployment and configuration issues and their reso
2727
|Moving virtual network to another resource group|You want to move your virtual network to a different resource group.|Moving a virtual network with Bastion isn't directly supported. You must first delete Bastion from the virtual network, then move the virtual network to the new resource group. Once the virtual network is in the new resource group, you can deploy Bastion to the virtual network.|
2828
|Force-tunneling Internet traffic|You're advertising a default route (0.0.0.0/0) over ExpressRoute or VPN.|Force-tunneling with Azure Bastion isn't supported if you're advertising a default route over ExpressRoute or VPN. Azure Bastion needs to communicate with certain internal endpoints. Ensure the host virtual network isn't linked to a private DNS zone with these exact names: management.azure.com, blob.core.windows.NET, core.windows.NET, vaultcore.windows.NET, vault.azure.NET, or azure.com. You can use private DNS zones ending with these names (for example: privatelink.blob.core.windows.NET). Azure Bastion isn't supported with Azure Private DNS Zones in national clouds.|
2929

30+
## SKU upgrade issues
31+
32+
This section describes common issues when upgrading your Azure Bastion SKU and their resolutions. For upgrade instructions, see [View or upgrade an Azure Bastion SKU](upgrade-sku.md).
33+
34+
|Issue |Description |Resolution |
35+
|---------|---------|---------|
36+
|Upgrade fails to start|When you try to upgrade your Bastion SKU, the operation fails immediately.|Verify you have Contributor or Owner role on the resource group containing your Bastion host.|
37+
|Upgrade fails with subnet error|Upgrade from Developer SKU fails with a subnet-related error.|Create a subnet named **AzureBastionSubnet** with a /26 or larger prefix before upgrading. The Developer SKU uses shared infrastructure, while Basic, Standard, and Premium require a dedicated subnet.|
38+
|Upgrade times out|The upgrade operation takes longer than expected or times out.|The upgrade process typically takes approximately 10 minutes. Wait a few minutes and check the Bastion host status in the portal. If the status shows updating, wait for completion. If the status shows failed, try the upgrade again.|
39+
|Features not available after upgrade|After upgrading, expected features aren't available.|Features must be explicitly enabled after upgrading. Go to your Bastion host, select **Configuration**, and enable the desired features available for your new SKU tier.|
40+
3041
## DNS and Private Link issues
3142

3243
This section describes common DNS and Private Link issues and their resolutions.

‎articles/bastion/upgrade-sku.md‎

Lines changed: 181 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,57 +1,211 @@
11
---
2-
title: Upgrade or view a SKU - portal
2+
title: View or upgrade an Azure Bastion SKU
33
titleSuffix: Azure Bastion
4-
description: Learn how to view a SKU and upgrade SKU tiers.
4+
description: Learn how to view your current Azure Bastion SKU and upgrade to a higher tier using the Azure portal or Azure CLI.
55
author: abell
66
ms.service: azure-bastion
77
ms.topic: how-to
8-
ms.date: 03/31/2025
8+
ms.date: 02/10/2026
99
ms.author: abell
1010

1111
# Customer intent: As an Azure administrator, I want to view and upgrade my Bastion SKU so that I can enhance the features and capabilities of my secure remote access setup.
1212
---
1313

14-
# View or upgrade a SKU
14+
# View or upgrade an Azure Bastion SKU
1515

16-
This article helps you view and upgrade your Bastion SKU. Once you upgrade, you can't revert back to a lower SKU without deleting and reconfiguring Bastion. For more information about features and SKUs, see [Configuration settings](configuration-settings.md).
16+
This article helps you view your current Azure Bastion SKU and upgrade to a higher tier. You can upgrade using the Azure portal or Azure CLI.
17+
18+
> [!IMPORTANT]
19+
> Once you upgrade, you can't revert to a lower SKU without deleting and reconfiguring Azure Bastion. Plan your upgrade carefully and consider starting with the tier that meets your long-term requirements.
20+
21+
To compare SKU features and determine which tier is right for you, see [Choose the right Azure Bastion SKU](bastion-sku-comparison.md).
1722

1823
[!INCLUDE [Pricing](~/reusable-content/ce-skilling/azure/includes/bastion-pricing.md)]
1924

20-
## View a SKU
25+
## Prerequisites
26+
27+
Before upgrading your Azure Bastion SKU, verify the following requirements:
28+
29+
- **Azure CLI**: If using Azure CLI, install the [bastion extension](/cli/azure/network/bastion). The extension installs automatically the first time you run an `az network bastion` command. Requires Azure CLI version 2.62.0 or higher.
30+
- **Permissions**: You need Contributor or Owner role on the resource group containing your Bastion host.
31+
- **Subnet requirements** (Developer SKU upgrade only): A subnet named **AzureBastionSubnet** with a prefix of /26 or larger (/25, /24, etc.) must exist in your virtual network or be created before upgrading.
32+
- **Public IP** (Developer SKU upgrade only): A Standard SKU public IP address with static allocation is required unless you're deploying Premium SKU with private-only configuration.
33+
34+
## Pre-upgrade considerations
35+
36+
### What happens during an upgrade
2137

22-
To view the SKU for your bastion host, use the following steps.
38+
- **Duration**: The upgrade process takes approximately 10 minutes to complete.
39+
- **Active sessions**: Existing connections might be briefly interrupted during the upgrade. Plan the upgrade during a maintenance window when possible.
40+
41+
### Cost implications
42+
43+
Upgrading to a higher SKU increases your hourly costs. Review the [Azure Bastion pricing page](https://azure.microsoft.com/pricing/details/azure-bastion/) to understand the cost difference between tiers before upgrading.
44+
45+
## View your current SKU
46+
47+
# [Portal](#tab/portal)
2348

2449
1. Sign in to the [Azure portal](https://portal.azure.com).
25-
1. In the Azure portal, go to your bastion host.
26-
1. In the left pane, select **Configuration** to open the Configuration page. Click through the different Tier options. Notice that the SKU affects the available features you can select for your bastion host.
50+
1. Go to your Bastion host.
51+
1. In the left pane, select **Configuration**. Your current SKU is displayed in the **Tier** dropdown. You can also see which features are available for each tier by selecting different options.
52+
53+
# [Azure CLI](#tab/cli)
54+
55+
Run the following command to view your current Bastion SKU:
56+
57+
```azurecli
58+
az network bastion show --name <bastion-name> --resource-group <resource-group-name> --query sku.name --output tsv
59+
```
60+
61+
> [!IMPORTANT]
62+
> When using `az network bastion update`, you must include the `--location` parameter matching the region of your existing Bastion host. If omitted, the CLI may default to a different region, resulting in an `InvalidResourceLocation` error.
63+
64+
---
65+
66+
## Upgrade from Developer SKU
67+
68+
The Developer SKU uses shared infrastructure. When you upgrade to Basic, Standard, or Premium, Azure Bastion switches to dedicated infrastructure, which requires a dedicated subnet and public IP address.
69+
70+
# [Portal](#tab/portal)
71+
72+
1. **Create the AzureBastionSubnet** (if it doesn't exist):
73+
1. Go to your virtual network in the Azure portal.
74+
1. Select **Subnets** > **+ Subnet**.
75+
1. Enter **AzureBastionSubnet** as the name (this exact name is required).
76+
1. Enter a subnet address range of /26 or larger.
77+
1. Select **Save**.
78+
79+
1. **Upgrade the Bastion host**:
80+
1. Go to your Bastion host.
81+
1. Select **Configuration** in the left pane.
82+
1. For **Tier**, select your target SKU (Basic, Standard, or Premium).
83+
1. For **Public IP address**, select an existing Standard SKU public IP or create a new one.
84+
1. The **Subnet** field automatically populates with your AzureBastionSubnet.
85+
1. (Optional) Enable any additional features you want to configure.
86+
1. Select **Apply**.
87+
88+
The upgrade takes approximately 10 minutes to complete.
89+
90+
# [Azure CLI](#tab/cli)
91+
92+
1. **Create the AzureBastionSubnet** (if it doesn't exist):
2793

28-
## Upgrade from Bastion Developer
94+
```azurecli
95+
az network vnet subnet create \
96+
--resource-group <resource-group-name> \
97+
--vnet-name <vnet-name> \
98+
--name AzureBastionSubnet \
99+
--address-prefixes <subnet-prefix>/26
100+
```
29101

30-
When you upgrade from Bastion Developer to a dedicated deployment SKU, you need to create a public IP address and an Azure Bastion subnet.
102+
1. **Create a public IP address** (if you don't have one):
31103

32-
Use the following steps to upgrade to a higher SKU.
104+
```azurecli
105+
az network public-ip create \
106+
--resource-group <resource-group-name> \
107+
--name <public-ip-name> \
108+
--sku Standard \
109+
--allocation-method Static
110+
```
33111

34-
1. In the Azure portal, go to your virtual network and add a new subnet. The subnet must be named **AzureBastionSubnet** and must be /26 or larger (/25, /24 etc.). This subnet will be used exclusively by Azure Bastion.
35-
1. Next, go to the portal page for your **Bastion** host.
36-
1. On the **Configuration** page, for **Tier**, select the SKU that you want to upgrade to. Notice that the available features change, depending on the SKU you select.
37-
1. Create a new public IP address value unless you have already created one for your bastion host, in which case, select the value.
38-
1. Because you already created the AzureBastionSubnet, the **Subnet** field will automatically populate.
39-
1. You can add features at the same time you upgrade the SKU. You don't need to upgrade the SKU and then go back to add the features as a separate step.
40-
1. Select **Apply** to apply changes. The bastion host updates. This procedure takes about 10 minutes to complete.
112+
1. **Upgrade the Bastion host**:
41113

42-
## Upgrade from the Basic or Standard SKU
114+
The `az network bastion update` command can't add the IP configuration required for dedicated infrastructure. Delete the Developer SKU Bastion host and create a new one with the target SKU:
43115

44-
Use the following steps to upgrade to a higher SKU.
116+
```azurecli
117+
az network bastion delete \
118+
--name <bastion-name> \
119+
--resource-group <resource-group-name>
120+
```
45121

46-
1. In the Azure portal, go to your Bastion host.
122+
```azurecli
123+
az network bastion create \
124+
--name <bastion-name> \
125+
--resource-group <resource-group-name> \
126+
--vnet-name <vnet-name> \
127+
--public-ip-address <public-ip-name> \
128+
--sku <Basic|Standard|Premium> \
129+
--location <location>
130+
```
47131

48-
1. On the **Configuration** page, for **Tier**, select a higher SKU.
132+
---
133+
134+
## Upgrade from Basic or Standard SKU
135+
136+
Basic, Standard, and Premium SKUs all use the same dedicated infrastructure, so upgrading between these tiers requires only a configuration change.
137+
138+
# [Portal](#tab/portal)
139+
140+
1. Go to your Bastion host in the Azure portal.
141+
1. Select **Configuration** in the left pane.
142+
1. For **Tier**, select the higher SKU you want to upgrade to.
143+
1. (Optional) Enable any additional features available with the new SKU.
144+
1. Select **Apply**.
145+
146+
The upgrade takes approximately 10 minutes to complete.
147+
148+
# [Azure CLI](#tab/cli)
149+
150+
Run the following command to upgrade your Bastion SKU:
151+
152+
```azurecli
153+
az network bastion update \
154+
--name <bastion-name> \
155+
--resource-group <resource-group-name> \
156+
--location <location> \
157+
--sku name=<Standard|Premium>
158+
```
159+
160+
To enable features during the upgrade, add the appropriate parameters. For example, to enable native client support and IP-based connection:
161+
162+
```azurecli
163+
az network bastion update \
164+
--name <bastion-name> \
165+
--resource-group <resource-group-name> \
166+
--location <location> \
167+
--sku name=Standard \
168+
--enable-tunneling true \
169+
--enable-ip-connect true
170+
```
171+
172+
---
173+
174+
## Verify the upgrade
175+
176+
After the upgrade completes, verify that your Bastion host is functioning correctly:
177+
178+
# [Portal](#tab/portal)
179+
180+
1. Go to your Bastion host and select **Configuration**.
181+
1. Verify the **Tier** shows your new SKU.
182+
1. Check that your desired features are enabled.
183+
1. Test a connection to a VM to confirm connectivity.
184+
185+
# [Azure CLI](#tab/cli)
186+
187+
1. Verify the SKU was updated:
188+
189+
```azurecli
190+
az network bastion show \
191+
--name <bastion-name> \
192+
--resource-group <resource-group-name> \
193+
--query "{Name:name, SKU:sku.name, ProvisioningState:provisioningState}" \
194+
--output table
195+
```
196+
197+
1. Confirm the provisioning state shows **Succeeded**.
198+
199+
---
49200

50-
1. You can add features at the same time you upgrade the SKU. You don't need to upgrade the SKU and then go back to add the features as a separate step.
201+
## Troubleshooting
51202

52-
1. Select **Apply** to apply changes. The bastion host updates. This procedure takes about 10 minutes to complete.
203+
If you encounter issues during or after the upgrade, see [Troubleshoot Azure Bastion](troubleshoot.md#sku-upgrade-issues).
53204

54205
## Next steps
55206

56-
* See [Configuration settings](configuration-settings.md).
57-
* Read the [Bastion FAQ](bastion-faq.md).
207+
- [Choose the right Azure Bastion SKU](bastion-sku-comparison.md)
208+
- [Configure host scaling](configure-host-scaling.md)
209+
- [Configure session recording](session-recording.md) (Premium SKU)
210+
- [Deploy private-only Bastion](private-only-deployment.md) (Premium SKU)
211+
- [About Bastion configuration settings](configuration-settings.md)

0 commit comments

Comments
 (0)