Site icon Digital Thought Disruption

Securing Remote Access: Entra-Powered Bastion Host Deployments on Azure Local SDN

Paul Bryant

Introduction

Remote administration is essential for modern IT environments. However, providing secure, auditable, and compliant access to internal workloads remains a constant challenge. With the rise of hybrid infrastructure, Azure Local (Azure Stack HCI with SDN Express) empowers organizations to leverage cloud-native security tools on-premises. In this guide, we walk through building robust Bastion/Jumpbox solutions for administrators, tightly integrated with Microsoft Entra authentication and SDN controls for secure ingress and comprehensive monitoring.

You will learn how to:

Table of Contents

  1. Understanding Bastion Hosts and Zero Trust
  2. Solution Architecture Overview
  3. Entra Authentication for Bastion Access
  4. Network Design with Azure Local SDN
  5. Step-by-Step Deployment Tutorial
    • Prerequisites
    • Network configuration (VNet, Subnet, NSG, SLB)
    • Bastion VM deployment
    • Entra integration
  6. Automated Provisioning with PowerShell and Bicep
  7. Monitoring and Auditing Remote Access
  8. Best Practices and Common Pitfalls
  9. Conclusion

Understanding Bastion Hosts and Zero Trust

A Bastion host (or jumpbox) is a hardened system placed on a network boundary that administrators use as a secure entry point to manage servers inside private subnets. Unlike exposing RDP or SSH ports to the world, the Bastion model limits attack surface and makes auditing straightforward.

Zero Trust principles require verifying every access request, enforcing least privilege, and constantly monitoring activity. Integrating Microsoft Entra authentication and Azure Local SDN, organizations can:

Solution Architecture Overview

Here’s how a typical Entra-powered Bastion on Azure Local SDN is structured:

Key components:

Entra Authentication for Bastion Access

Why Entra?

Microsoft Entra (formerly Azure Active Directory) provides identity-driven access control for all cloud and hybrid resources. For Bastion deployments, Entra enables:

Setting up Entra for Bastion Access

  1. Register the Bastion App:
    In Entra, create an enterprise application for your Bastion or RDP gateway, if not using native Azure Bastion.
  2. Assign Admin Roles:
    Use built-in or custom roles to restrict access. Assign only the required users/groups.
  3. Configure Conditional Access:
    Define rules for allowed locations, devices, MFA requirements, session controls, and more.
  4. Enable MFA:
    Enforce MFA for all privileged users.
  5. Audit Sign-In Logs:
    Set up Log Analytics or forward to SIEM for ongoing monitoring.

Network Design with Azure Local SDN

SDN Components in Azure Local

Sample Topology

Subnet NamePurposeExample Address Range
BastionSubnetBastion host only10.10.1.0/27
WorkloadSubnetApplication servers10.10.2.0/24
ManagementSubnetManagement-only traffic10.10.3.0/24

Tip: Use NSG rules to allow only Entra-authenticated traffic to the Bastion and deny all public inbound connections except from approved locations.

Step-by-Step Deployment Tutorial

Prerequisites

1. Define and Deploy Network Segments

PowerShell Example:

# Connect to your Azure Stack HCI host
Connect-AzAccount
$rg = "SDNResourceGroup"
$location = "local"
# Create a VNet
New-AzVirtualNetwork -ResourceGroupName $rg -Location $location `
  -Name "SDNVNet" -AddressPrefix "10.10.0.0/16"

# Add subnets
Add-AzVirtualNetworkSubnetConfig -Name "BastionSubnet" -AddressPrefix "10.10.1.0/27"
Add-AzVirtualNetworkSubnetConfig -Name "WorkloadSubnet" -AddressPrefix "10.10.2.0/24"

2. Create NSG Rules for Bastion Access

Example NSG Rule:

# Allow inbound RDP from trusted admin IP range
Add-AzNetworkSecurityRuleConfig -Name "Allow-RDP-Admins" `
  -Protocol "Tcp" -Direction "Inbound" -Priority 100 `
  -SourceAddressPrefix "AdminOfficeIP/32" -SourcePortRange "*" `
  -DestinationAddressPrefix "*" -DestinationPortRange 3389 -Access "Allow"

3. Deploy the Bastion Host VM

Provision a hardened Windows or Linux VM on the BastionSubnet.

Bicep Example:

resource bastionVM 'Microsoft.Compute/virtualMachines@2023-03-01' = {
  name: 'BastionHost01'
  location: location
  properties: {
    hardwareProfile: { vmSize: 'Standard_D2s_v3' }
    osProfile: {
      computerName: 'BastionHost01'
      adminUsername: 'adminuser'
      adminPassword: 'securePasswordHere!'
    }
    networkProfile: {
      networkInterfaces: [
        {
          id: nic.id
        }
      ]
    }
    # Harden with minimum services, update regularly, disable unused ports
  }
}

4. Integrate Bastion Host with Entra

5. Enable Monitoring and Alerting

Sample Kusto Query for Login Monitoring:

SecurityEvent
| where AccountType == "User" and EventID == 4624
| where TargetUserName contains "admin"
| project TimeGenerated, TargetUserName, IpAddress, Computer

Automated Provisioning with PowerShell and Bicep

Combining Bicep and PowerShell scripts streamlines the deployment of repeatable Bastion environments.

Sample Workflow:

  1. Admin runs a PowerShell script that triggers Bicep template deployment
  2. Bicep provisions VNet, subnets, NSGs, Bastion VM, and connects to Entra
  3. Post-deployment script applies custom hardening and monitoring agents

PowerShell Deployment Example:

New-AzResourceGroupDeployment -ResourceGroupName $rg -TemplateFile './bastion.bicep'

Monitoring and Auditing Remote Access

Centralized logging is non-negotiable for secure remote access.

Log SourceWhat to Monitor
Entra Sign-in LogsUnusual login attempts
Bastion VMRDP/SSH/console sessions
NSG Flow LogsUnexpected traffic patterns
SLB LogsLoad balancing anomalies

Best Practices and Common Pitfalls

Best Practices:

Common Pitfalls:

Conclusion

Securing remote admin access in hybrid environments is critical for operational integrity and compliance. With Azure Local SDN and Entra-powered Bastion hosts, organizations gain a flexible, scalable, and cloud-aligned way to control, monitor, and audit all privileged ingress, without exposing unnecessary risk. By combining strong identity management, robust network controls, and comprehensive monitoring, your IT team can embrace hybrid operations confidently and securely.

Disclaimer: The views expressed in this article are those of the author and do not represent the opinions of Microsoft, my employer or any affiliated organization. Always refer to the official Microsoft documentation before production deployment.

Exit mobile version