Restrict access to a shareable Azure Bastion URL to certain IP addresses

Question

I have a Windows VM that I connect to using RDP. For security reasons, I created a Bastion and a shareable URL so that I can give it to the client to connect via Bastion.

The client will connect using the shareable URL (using HTTPS), then choose the RDP protocol and the RDP port. I have restricted the RDP port to allow only certain IP addresses. However, this does not work with the shareable URL.

is it possible?

Answer 1

I tried to reproduce the same in my environment and created a virtual machine and shareable URL like below:

Created a virtual network with a bastion subnet like below:

Created bastion and shareable URL like below:

When I try to restrict access for certain IP addresses using NSG it is restricted successfully like below:

Note: Using the Network security group you can restrict access to the RDP protocol. unfortunately in Bastion shareable link, it's not possible to restrict access to the certain IP address

Peered VNets that have various subscriptions, Peer VNets across the tenants, peered VNets in different regions, and national clouds are currently not supported in shareable URL

Reference:

Create a shareable link for Azure Bastion | Microsoft Learn