Merge pull request #312321 from asudbring/tsk556113-sfi-bastion

SFI Bastion update: create-multiple-sites-portal.md

Author: prmerger-automator[bot]

articles/application-gateway/create-multiple-sites-portal.md

@@ -6,7 +6,7 @@ services: application-gateway
 author: mbender-ms
 ms.service: azure-application-gateway
 ms.topic: tutorial
-ms.date: 06/13/2023
+ms.date: 02/26/2026
 ms.author: mbender
 ms.custom: sfi-image-nochange
 #Customer intent: As an IT administrator, I want to use the Azure portal to set up an application gateway so I can host multiple sites.
@@ -170,13 +170,17 @@ To add backend targets, you'll:
     - **Region**: Select the same region that you used before.
     - **Username**: Enter a name for the administrator user name.
     - **Password**: Enter a password for the administrator.
-1. Accept the other defaults and then select **Next: Disks**.  
+    - **Public inbound ports**: Select **None**.
+1. Accept the other defaults and then select **Next: Disks**.
 2. Accept the **Disks** tab defaults and then select **Next: Networking**.
-3. On the **Networking** tab, verify that **myVNet** is selected for the **Virtual network** and the **Subnet** is set to **myBackendSubnet**. Accept the other defaults and then select **Next: Management**.<br>Application Gateway can communicate with instances outside of the virtual network that it is in, but you need to ensure there's IP connectivity.
+3. On the **Networking** tab, verify that **myVNet** is selected for the **Virtual network** and the **Subnet** is set to **myBackendSubnet**. Set **Public IP** to **None**. Accept the other defaults and then select **Next: Management**.<br>Application Gateway can communicate with instances outside of the virtual network that it is in, but you need to ensure there's IP connectivity.
 4. On the **Management** tab, set **Boot diagnostics** to **Disable**. Accept the other defaults and then select **Review + create**.
 5. On the **Review + create** tab, review the settings, correct any validation errors, and then select **Create**.
 6. Wait for the virtual machine creation to complete before continuing.
 
+> [!NOTE]
+> The default rules of the network security group block all inbound access from the internet, including RDP. To connect to the virtual machine, use Azure Bastion. For more information, see [Quickstart: Deploy Azure Bastion with default settings](../bastion/quickstart-host-portal.md).
+
 ### Install IIS for testing
 
 In this example, you install IIS on the virtual machines only to verify Azure created the application gateway successfully.