Best Practices for Securing Access to VMs

In the Azure portal, under the Privileged Identity Management resource, there are two Assignment Types that a user may have: 

• Eligible assignments require the member of the role to perform an action to use the role. Actions might include performing a multifactor authentication (MFA) check, providing a business justification, or requesting approval from designated approvers. 

• Active assignments don't require the member to perform any action to use the role. Members assigned as active always have the privileges assigned to the role. 

Let’s explore how combining these two services supports a zero-trust approach to VM access.

Example Customer Use Case

Under the company Contoso, user Adam would like to access a virtual machine to do monthly patching work. Adam’s manager, Jane, is the administrator of the subscription and approves/denies all access to the virtual machines. Jane has set up access to the virtual machines in her subscription in a way that everyone who needs to use the virtual machine has “Eligible” access to it. Additionally, she has set up a network security rule that blocks all inbound traffic to their VMs except from Bastion. This way, it ensures a Zero-Trust approach, not only protecting the VMs from network-level attacks, but also limiting access to the VM on a “as-necessary” basis. 

Since Adam only has Eligible access to the virtual machine, the resource is not visible in the portal. To gain access to the virtual machine, Adam goes to Privileged Identity Management resource in the portal and under Azure roles, he selects “Eligible assignments” and clicks on the role that he would like to activate. 

Once Jane approves the request, Adam will gain access to the virtual machine for the next X hours. Azure Bastion acts as a secure gateway between Adam and the VM, eliminating the need for a public IP on the VM. Instead, Adam connects through Bastion’s public IP and is authenticated using his Microsoft Entra ID credentials. If session recording is enabled on Bastion, all of Adam’s activity within the VM is graphically captured and stored in a designated storage account container. These recordings can be reviewed at any time via the Bastion resource blade. When the JIT (Just-In-Time) access window expires, Adam's access is automatically revoked, returning the VM to a zero-access state. 

Conclusion

Azure Bastion eliminates the need for public IP addresses on virtual machines, significantly reducing their exposure to the internet. It integrates seamlessly with Entra ID, allowing users to authenticate directly to VMs without relying on local credentials. When combined with Just-In-Time (JIT) access through Microsoft Entra Privileged Identity Management (PIM), Bastion adds an extra layer of security—ensuring that even authorized users can only connect to VMs during approved time windows. This layered approach not only simplifies secure connectivity but also reinforces a strong Zero Trust access model.