docs: Replace Bastion deployment with NSG note and remove public IP

Author: asudbring

articles/dns/private-dns-getstarted-portal.md

@@ -4,7 +4,7 @@ description: In this quickstart, you create and test a private DNS zone and reco
 services: dns
 author: asudbring
 ms.author: allensu
-ms.date: 07/11/2025
+ms.date: 02/26/2026
 ms.topic: quickstart
 ms.service: azure-dns
 ms.custom:
@@ -98,32 +98,6 @@ Next, link the private DNS zone to the virtual network by adding a virtual netwo
 
 5. Select **Create**, wait until the virtual link is created, and then verify that it is listed on the **Virtual Network Links** page.
 
-## Deploy Azure Bastion
-
-Azure Bastion uses your browser to connect to VMs in your virtual network over secure shell (SSH) or remote desktop protocol (RDP) by using their private IP addresses. The VMs don't need public IP addresses, client software, or special configuration. For more information about Azure Bastion, see [Azure Bastion](/azure/bastion/bastion-overview).
-
->[!NOTE]
->[!INCLUDE [Pricing](~/reusable-content/ce-skilling/azure/includes/bastion-pricing.md)]
-
-1. In the search box at the top of the portal, enter **Bastion**. Select **Bastions** in the search results.
-2. Select **+ Create**.
-3. In the **Basics** tab of **Create a Bastion**, enter, or select the following information:
-
-    | Setting | Value |
-    |---|---|
-    | **Project details** |  |
-    | Subscription | Select your subscription. |
-    | Resource group | Select **MyResourceGroup**. |
-    | **Instance details** |  |
-    | Name | Enter **bastion**. |
-    | Region | Select **(US) West US**. |
-    | Tier | Select **Developer**. |
-    | **Configure virtual networks** |  |
-    | Virtual network | Select **MyVNet**. |
-
-4. Select **Review + create**.
-5. Select **Create**.
-
 ## Create the test virtual machine
 
 Now, create a virtual machine to test autoregistgration in your private DNS zone:
@@ -144,6 +118,9 @@ Now, create a virtual machine to test autoregistgration in your private DNS zone
 14. Review the settings and then click **Create**. It will take a few minutes for the virtual machine allocation to complete.
 15. Search for and select **Virtual machines** and then verify that the VM status is **Running**. If it isn't running, start the virtual machine.
 
+> [!NOTE]
+> The default rules of the network security group block all inbound access from the internet, including RDP. To connect to the virtual machine, use Azure Bastion. For more information, see [Quickstart: Deploy Azure Bastion with default settings](../bastion/quickstart-host-portal.md).
+
 ## Review autoregistration
 
 1. Search for or select **Private DNS zones** and then select the **private.contoso.com** zone.