SSH Session Manager vs Azure Bastion: Which Path?

For securely reaching Azure VMs, Azure Bastion is the fully managed PaaS service that gives browser-based RDP/SSH without a public IP, while an SSH session manager (like a jump server or tools such as Apache Guacamole) is a self-managed gateway you control and patch yourself. Choose Bastion when you want zero maintenance and native Azure integration; choose a session manager when you need deep customization, legacy protocol support, or want to avoid per-hour data transfer costs.

Background: Why the Access Path Matters

Every Azure VM traditionally exposes a public IP with port 22 open for SSH. That is simple but dangerous: bots scan the entire internet for open SSH ports and attempt brute-force logins constantly. The industry response has been to hide VMs behind a gateway that authenticates users first. Two popular patterns emerged: a jump host (a small VM you SSH into, then hop to others) and Azure Bastion (a Microsoft-managed service that brokers the connection through the Azure portal).

An SSH session manager is a broader category that includes jump hosts, but also tools that record sessions, enforce MFA, and let you manage keys centrally. Some are open-source (like Apache Guacamole or Teleport), some are commercial. The key difference from Bastion is that you run them on VMs you control, so you own the patching, scaling, and high-availability story.

How Azure Bastion Works

Bastion is deployed inside a VNet, attached to a subnet named AzureBastionSubnet. When a user connects, the Bastion service authenticates them against Azure AD (or local VM credentials) and then opens a secure WebSocket tunnel to the target VM’s private IP. No public IP is needed on the VM, and no inbound port is opened on the VM’s NSG—the connection is initiated from Bastion to the VM over the private network.

Users access it through the Azure portal, clicking “Connect” on a VM and choosing Bastion. The browser renders an SSH or RDP session via HTML5, so no local client is required. This is a huge plus for locked-down corporate laptops where installing PuTTY or an SSH client is forbidden.

How SSH Session Managers Work

A session manager is a server (or cluster) that acts as a proxy. Users connect to the manager—often over HTTPS or SSH—and the manager then opens a connection to the target VM using stored credentials or a key vault. The manager can log every keystroke, record the screen, and enforce policies like “only allow connections from 9 AM to 5 PM.”

For example, a simple jump host is just a Linux VM with SSH. Users SSH to the jump host, then from there SSH to the target VM. More advanced tools like Teleport use short-lived certificates and integrate with SSO; Guacamole provides a web-based gateway that supports RDP, VNC, and SSH. You can run these on a single VM or scale them out behind a load balancer.

How to Choose: Decision Factors

No single answer fits every environment. Ask these questions:

• Do you want to manage the gateway? Bastion is fully managed—Microsoft patches it, scales it, and handles availability. A session manager is your responsibility.
• What protocols do you need? Bastion supports SSH (port 22) and RDP (port 3389). If you need VNC, telnet, or custom ports, you need a session manager.
• What is your cost model? Bastion charges per hour plus data transfer out. A session manager costs only the VM compute, but you add patching time and potential downtime.
• Do you need session recording? Bastion does not record sessions. Many session managers do—critical for compliance in finance or healthcare.
• Do you need to connect to on-premises servers? Bastion only works for Azure VMs. A session manager can also reach on-prem machines if it has network path to them.
• What is your team’s skill set? If you have no Linux admin, Bastion is far easier. If you already run jump hosts, a session manager may be natural.

Common Problems and Misconceptions

A frequent misconception is that Bastion is “just a jump host in the portal.” That is wrong—Bastion does not give you a shell on a jump VM; it brokers a connection directly to the target. You cannot install tools on Bastion or use it as a general-purpose proxy.

Another issue: Bastion requires the AzureBastionSubnet to be at least /27. If you try to deploy it in a smaller subnet, it fails. Also, Bastion does not support connecting to VMs in a different VNet unless you peer the VNets and configure the appropriate routing.

On the session manager side, the most common problem is key management. If you store private keys on the jump host, a compromised jump host exposes all your VMs. Use an agent that forwards keys or integrates with a secrets vault, and enforce MFA on the gateway itself.

Cost Comparison

Bastion pricing is based on the number of instances you deploy (each is a scale unit) plus data transfer out (the amount of data flowing through the tunnel). For a small environment, that can be a few hundred dollars a month. A session manager on a single B2s VM costs roughly the same in compute, but you also pay for managed disks, backups, and your time to maintain it.

However, if you have hundreds of users and high session traffic, Bastion’s data transfer charges can add up. A session manager with a load balancer might be cheaper at scale, but you must factor in the cost of high availability (at least two VMs) and the risk of misconfiguration.

Security and Compliance

Both paths can be secure if configured correctly. Bastion integrates with Azure AD and Conditional Access, so you can require MFA and device compliance. It also logs connection events in the Azure Activity Log. But it does not record the session content, and it does not allow you to restrict which commands a user runs inside the VM.

Session managers can offer finer control: you can define roles that allow only certain commands (e.g., systemctl restart nginx but not rm -rf), record video of the session, and even replay it later. This is often required by PCI-DSS or SOC 2. The tradeoff is that you must secure the manager itself—patch it, harden it, and monitor it. A misconfigured session manager can be a bigger risk than a public IP if it is left open to the internet.

Alternatives to Both

Before settling, consider other options:

• Just use a public IP with strong auth: If you only have one VM and use key-based SSH with no password, a public IP is not catastrophic. But it still exposes you to scanning and zero-day exploits.
• VPN: A site-to-site VPN or point-to-site VPN lets you reach private IPs without a gateway. But VPN clients add friction, and a compromised VPN is a single point of failure.
• Azure AD Domain Services + SSH: You can use Azure AD to authenticate SSH to Linux VMs, but you still need a way to reach the private IP.
• Tailscale or similar mesh VPN: These overlay networks give each VM a private IP and use WireGuard. They are simple but add a third-party dependency.

Frequently Asked Questions

Can Azure Bastion connect to a VM that has no public IP? Yes, that is its primary purpose. The VM only needs a private IP and the Bastion subnet must have network path to it.

Does Bastion support SSH keys stored in Azure Key Vault? Yes, you can store SSH private keys in Key Vault and Bastion will use them to authenticate. You can also use Azure AD authentication for Linux VMs if you have the AAD extension installed.

Can I use a session manager to connect to Azure VMs and on-prem servers? Yes, as long as the session manager has network access to both. That is a common reason to choose a session manager over Bastion.

Is Bastion more secure than a jump host? Not inherently. Both are secure if patched and configured properly. Bastion reduces your attack surface because it is managed by Microsoft, but you still need to secure the VMs themselves.

What happens if the Bastion service goes down? You lose access to your VMs through the portal, but the VMs themselves are unaffected. You could still reach them via a VPN or a direct private connection if you have one.

Can I record SSH sessions with Azure Bastion? No, Bastion does not provide session recording. You would need a session manager or a third-party tool for that.

Related

• Samsung S23 Accessories: The Essential List
• Choose a Private AI Search Engine: Step-by-Step
• Cheapest Ark Survival Evolved Server Hosting That’s Still Good