Hello experts! I want to deploy the Azure Bastion in the Hub Vnet which is in the subscription A. How we can deploy and configure the Bastion so that every Server/ VM present in the Spoke uses the Bastion of the Hub? Remember that we have multiple subscriptions in the environment. Subscription A is the HUB and all the other subscriptions are SPOKE connected to the HUB through Vnet peering. Thanks! Nidhi.

@Nidhi Priya Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. This is supported. Connectivity via Bastion will continue to work for peered VNets across different subscription as long as they are in a single Tenant. Subscriptions across two different Tenants aren't supported. Refer FAQ : If my peered VNets are deployed in different subscriptions, will connectivity via Bastion work? Thanks, Kapil Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.

Deploy Azure Bastion in the Hub and Spoke architecture?

Accepted answer

KapilAnanth-MSFT 39,461 Reputation points Microsoft Employee

2023-12-14T04:30:49.6166667+00:00
@Nidhi Priya

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

This is supported.

Connectivity via Bastion will continue to work for peered VNets across different subscription as long as they are in a single Tenant.

Subscriptions across two different Tenants aren't supported.

Refer FAQ : If my peered VNets are deployed in different subscriptions, will connectivity via Bastion work?

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.
Please sign in to rate this answer.
Nidhi Priya 426 Reputation points

2023-12-14T04:36:55.3+00:00

Thanks, @KapilAnanth-MSFT for your response.

In my case, this will be supported.

But how we can deploy this?

I have deployed Bastion earlier also but in the one subscription. Now I have multiple subscriptions in the same tenant, Can you provide me any link for the document for reference?

Thanks!

Nidhi.

KapilAnanth-MSFT 39,461 Reputation points Microsoft Employee

2023-12-14T04:42:25.9933333+00:00

@Nidhi Priya

You must deploy the Bastion in the Hub VNET.

This means, the subscription of Bastion would be same as the Hub VNET's.

For architecture, refer : https://video2.skills-academy.com/en-us/azure/bastion/vnet-peering

For permissions, refer : https://video2.skills-academy.com/en-us/azure/bastion/bastion-faq#i-have-access-to-the-peered-vnet-but-i-cant-see-the-vm-deployed-there

i.e., the user trying to connect via Bastion must have the below permissions

Reader role on the virtual machine.

Reader role on the NIC with private IP of the virtual machine.

Reader role on the Azure Bastion resource.

Reader role on the virtual networks of the target virtual machines

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.
Sign in to comment

Share via

Deploy Azure Bastion in the Hub and Spoke architecture?

0 additional answers