Configure Azure Bastion or just-in-time (JIT) for administrative access to session hosts

In the world of cloud computing, security is of utmost importance. As more and more organizations adopt virtual desktop solutions like Microsoft Azure Virtual Desktop, it becomes crucial to ensure secure administrative access to session hosts. Azure Bastion and Just-in-Time (JIT) access are two powerful features that can help achieve this goal. In this article, we will explore how to configure Azure Bastion or JIT for administrative access to session hosts.

Azure Bastion

Azure Bastion is a fully managed platform as a service (PaaS) that provides secure and seamless RDP and SSH access to virtual machines directly from the Azure portal without the need for a public IP address. It eliminates the need to expose virtual machines to the public internet by routing traffic through a secure and dedicated gateway.

To configure Azure Bastion for administrative access to session hosts, follow these steps:

1. Open the Azure portal and navigate to the desired Azure Virtual Desktop workspace.
2. Click on “Session hosts” in the left navigation menu and select the session host you want to configure.
3. In the session host overview page, click on “Networking” under Settings.
4. On the Networking page, click on “Add inbound port rule” and select “RDP” or “SSH” depending on the protocol you want to enable.
5. In the Rule name field, enter a descriptive name for the rule.
6. Choose the appropriate source IP address range for access. You can specify a specific IP address or a range of IP addresses.
7. Select “AzureBastionSubnet” as the Target subnet.
8. Click on “Save” to create the inbound port rule.
9. Repeat steps 4-8 for each protocol (RDP and SSH) you want to enable.

Once the Azure Bastion configuration is complete, you can now securely access the session host using the Azure portal. Simply navigate to the session host in the Azure portal, click on “Connect” and select “Bastion” as the method. This will open a browser-based RDP or SSH session to the session host over a secure connection.

Just-in-Time (JIT) Access

Just-in-Time (JIT) access is another security feature provided by Azure Virtual Desktop that reduces the attack surface by only allowing inbound traffic to session hosts when it is needed. JIT access helps prevent unauthorized access by temporarily opening the necessary ports for a specified duration and then automatically closing them once the specified time elapses.

To configure JIT access for administrative access to session hosts, follow these steps:

1. Open the Azure portal and navigate to the desired Azure Virtual Desktop workspace.
2. Click on “Session hosts” in the left navigation menu and select the session host you want to configure.
3. In the session host overview page, click on “Security” under Settings.
4. On the Security page, click on “Just-in-Time VM access” to open the JIT access configuration.
5. In the JIT access configuration page, click on “Add” to create a new rule.
6. Select either “RDP” or “SSH” as the protocol, depending on your requirement.
7. Specify the maximum request duration for how long the ports should remain open. This can range from a few minutes to several hours.
8. Choose the appropriate source IP address range for access. You can specify a specific IP address or a range of IP addresses.
9. Click on “Save” to create the JIT access rule.

Once the JIT access rule is created, you can now request access to the session host for the specified duration. To request access, navigate to the session host in the Azure portal, click on “Connect” and select “JIT” as the method. This will open a browser-based RDP or SSH session to the session host for the specified time period.

Conclusion

Securing administrative access to session hosts is crucial to ensure the integrity and confidentiality of your virtual desktop infrastructure. Azure Bastion and Just-in-Time (JIT) access are two powerful features provided by Azure Virtual Desktop that can help achieve this goal. By following the steps outlined in this article, you can configure Azure Bastion or JIT access to provide secure administrative access to your session hosts. Stay secure and keep your virtual desktop environment protected!