az network bastion

Note

This reference is part of the bastion extension for the Azure CLI (version 2.62.0 or higher). The extension will automatically install the first time you run an az network bastion command. Learn more about extensions.

Manage Azure Bastion host machines.

Commands

Name	Description	Type	Status
az network bastion create	Create the specified Bastion Host.	Extension	GA
az network bastion delete	Delete the specified Bastion Host.	Extension	GA
az network bastion list	List all Bastion Hosts in a resource group.	Extension	GA
az network bastion rdp	RDP to target Virtual Machine using Tunneling from Azure Bastion.	Extension	GA
az network bastion show	Get the specified Bastion Host.	Extension	GA
az network bastion ssh	SSH to a virtual machine using Tunneling from Azure Bastion.	Extension	GA
az network bastion tunnel	Open a tunnel through Azure Bastion to a target virtual machine.	Extension	GA
az network bastion update	Update the specified Bastion Host.	Extension	GA
az network bastion wait	Place the CLI in a waiting state until a condition is met.	Extension	GA

az network bastion create

Create the specified Bastion Host.

az network bastion create --name
                          --resource-group
                          --vnet-name
                          [--acquire-policy-token]
                          [--change-reference]
                          [--disable-copy-paste {0, 1, f, false, n, no, t, true, y, yes}]
                          [--enable-ip-connect {0, 1, f, false, n, no, t, true, y, yes}]
                          [--enable-tunneling {0, 1, f, false, n, no, t, true, y, yes}]
                          [--file-copy {0, 1, f, false, n, no, t, true, y, yes}]
                          [--kerberos {0, 1, f, false, n, no, t, true, y, yes}]
                          [--location]
                          [--network-acls-ips]
                          [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                          [--public-ip-address]
                          [--scale-units]
                          [--session-recording {0, 1, f, false, n, no, t, true, y, yes}]
                          [--shareable-link {0, 1, f, false, n, no, t, true, y, yes}]
                          [--sku {Basic, Developer, Premium, Standard}]
                          [--tags]
                          [--zones]

Examples

Create a Azure Bastion host machine.

az network bastion create --location westus2 --name MyBastionHost --public-ip-address MyPublicIpAddress --resource-group MyResourceGroup --vnet-name MyVnet

Create Bastion Host With Zones

az network bastion create --location westus2 --name MyBastionHost --public-ip-address MyPublicIpAddress --resource-group MyResourceGroup --vnet-name MyVnet --zones 1 2 3

Create Bastion Host with Session Recording.

az network bastion create --location westus2 --name MyBastionHost --public-ip-address MyPublicIpAddress --resource-group MyResourceGroup --vnet-name MyVnet --zones 1 2 3 --sku Premium --session-recording

Create Developer SKU Bastion

az network bastion create --name MyBastion --resource-group MyResourceGroup --sku Developer --vnet-name MyVnet

Create Developer SKU Bastion with Network ACLs IP rules

az network bastion create --name MyBastion --resource-group MyResourceGroup --sku Developer --vnet-name MyVnet --network-acls-ips "1.1.1.1/16 100.64.0.0/10"

Required Parameters

--name -n

The name of the Bastion Host.

--resource-group -g

Resource group name of the Bastion Host.

--vnet-name

Name or Resource ID of the Virtual Network. For all SKUs but Developer SKU, this virtual network must have a subnet called AzureBastionSubnet.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--disable-copy-paste

Enable/Disable Copy/Paste feature of the Bastion Host resource.

Property	Value
Parameter group:	Properties Arguments
Default value:	False
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--enable-ip-connect

Enable/Disable IP Connect feature of the Bastion Host resource.

Property	Value
Parameter group:	Properties Arguments
Default value:	False
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--enable-tunneling

Enable/Disable Tunneling feature of the Bastion Host resource.

Property	Value
Parameter group:	Properties Arguments
Default value:	False
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--file-copy

Enable/Disable File Copy feature of the Bastion Host resource.

Property	Value
Parameter group:	Properties Arguments
Default value:	False
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--kerberos

Enable/Disable Kerberos feature of the Bastion Host resource.

Property	Value
Parameter group:	Properties Arguments
Default value:	False
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--location -l

Resource location.

Property	Value
Parameter group:	Parameters Arguments

--network-acls-ips

[Supported in Developer SKU only] Network ACLs IP rules. Space-separated list of IP addresses.

Property	Value
Parameter group:	Properties Arguments

--no-wait

Do not wait for the long-running operation to finish.

Property	Value
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--public-ip-address

[Required for all SKUs but Developer SKU] Name or Resource ID of the Public IP. The SKU of the public IP must be Standard.

--scale-units

The scale units for the Bastion Host resource.

Property	Value
Parameter group:	Properties Arguments
Default value:	2

--session-recording

Enable/Disable Session Recording feature of the Bastion Host resource.

Property	Value
Parameter group:	Properties Arguments
Default value:	False
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--shareable-link

Enable/Disable Shareable Link of the Bastion Host resource.

Property	Value
Parameter group:	Properties Arguments
Default value:	False
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--sku

The name of the sku of this Bastion Host.

Property	Value
Default value:	Standard
Accepted values:	Basic, Developer, Premium, Standard

--tags

Resource tags. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Parameters Arguments
Default value:	{}

--zones

A list of availability zones denoting where the resource needs to come from. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Parameters Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az network bastion delete

Delete the specified Bastion Host.

az network bastion delete [--acquire-policy-token]
                          [--change-reference]
                          [--ids]
                          [--name]
                          [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                          [--resource-group]
                          [--subscription]
                          [--yes]

Examples

Delete a Azure Bastion host machine.

az network bastion delete --name MyBastionHost --resource-group MyResourceGroup

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property	Value
Parameter group:	Resource Id Arguments

--name -n

The name of the Bastion Host.

Property	Value
Parameter group:	Resource Id Arguments

--no-wait

Do not wait for the long-running operation to finish.

Property	Value
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--resource-group -g

Resource group name of the Bastion Host.

Property	Value
Parameter group:	Resource Id Arguments

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property	Value
Parameter group:	Resource Id Arguments

--yes -y

Do not prompt for confirmation.

Property	Value
Default value:	False

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az network bastion list

List all Bastion Hosts in a resource group.

az network bastion list [--max-items]
                        [--next-token]
                        [--resource-group]

Examples

List all Azure Bastion host machines in a resource group.

az network bastion list -g MyResourceGroup

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--max-items

Total number of items to return in the command's output. If the total number of items available is more than the value specified, a token is provided in the command's output. To resume pagination, provide the token value in --next-token argument of a subsequent command.

Property	Value
Parameter group:	Pagination Arguments

--next-token

Token to specify where to start paginating. This is the token value from a previously truncated response.

Property	Value
Parameter group:	Pagination Arguments

--resource-group -g

Resource group name of the Bastion Host.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az network bastion rdp

RDP to target Virtual Machine using Tunneling from Azure Bastion.

az network bastion rdp [--acquire-policy-token]
                       [--auth-type]
                       [--change-reference]
                       [--configure]
                       [--disable-gateway {false, true}]
                       [--enable-mfa {false, true}]
                       [--ids]
                       [--name]
                       [--resource-group]
                       [--resource-port]
                       [--subscription]
                       [--target-ip-address]
                       [--target-resource-id]

Examples

RDP to virtual machine using Azure Bastion.

az network bastion rdp --name MyBastionHost --resource-group MyResourceGroup --target-resource-id vmResourceId

RDP to machine using reachable IP address.

az network bastion rdp --name MyBastionHost --resource-group MyResourceGroup --target-ip-address 10.0.0.1

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--auth-type

Auth type to use for RDP connections.

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--configure

Flag to configure RDP session.

Property	Value
Default value:	False

--disable-gateway

Flag to disable access through RD gateway.

Property	Value
Default value:	False
Accepted values:	false, true

--enable-mfa

Login to AAD enabled Windows machines using new protocol that authenticates using MFA if supported by target machine. Available on Windows 10 20H2+, Windows 11 21H2+, WS 2022.

Property	Value
Default value:	False
Accepted values:	false, true

--ids

Property	Value
Parameter group:	Resource Id Arguments

--name -n

Name of the bastion host.

Property	Value
Parameter group:	Resource Id Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property	Value
Parameter group:	Resource Id Arguments

--resource-port

Resource port of the target VM to which the bastion will connect.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property	Value
Parameter group:	Resource Id Arguments

--target-ip-address

IP address of target Virtual Machine.

--target-resource-id

ResourceId of the target Virtual Machine.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az network bastion show

Get the specified Bastion Host.

az network bastion show [--ids]
                        [--name]
                        [--resource-group]
                        [--subscription]

Examples

Show a Azure Bastion host machine.

az network bastion show --name MyBastionHost --resource-group MyResourceGroup

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--ids

Property	Value
Parameter group:	Resource Id Arguments

--name -n

The name of the Bastion Host.

Property	Value
Parameter group:	Resource Id Arguments

--resource-group -g

Resource group name of the Bastion Host.