az network bastion
Note
This reference is part of the bastion extension for the Azure CLI (version 2.43.0 or higher). The extension will automatically install the first time you run an az network bastion command. Learn more about extensions.
Manage Azure Bastion host machines.
Commands
Name | Description | Type | Status |
---|---|---|---|
az network bastion create |
Create a Azure Bastion host machine. |
Extension | Preview |
az network bastion delete |
Delete a Azure Bastion host machine. |
Extension | Preview |
az network bastion list |
List all Azure Bastion host machines. |
Extension | Preview |
az network bastion rdp |
RDP to target Virtual Machine using Tunneling from Azure Bastion. |
Extension | GA |
az network bastion show |
Show a Azure Bastion host machine. |
Extension | Preview |
az network bastion ssh |
SSH to a virtual machine using Tunneling from Azure Bastion. |
Extension | GA |
az network bastion tunnel |
Open a tunnel through Azure Bastion to a target virtual machine. |
Extension | GA |
az network bastion update |
Update a Azure Bastion host machine. |
Extension | Preview |
az network bastion wait |
Place the CLI in a waiting state until a condition is met. |
Extension | GA |
az network bastion create
This command is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Create a Azure Bastion host machine.
az network bastion create --name
--public-ip-address
--resource-group
--vnet-name
[--disable-copy-paste {0, 1, f, false, n, no, t, true, y, yes}]
[--enable-ip-connect {0, 1, f, false, n, no, t, true, y, yes}]
[--enable-tunneling {0, 1, f, false, n, no, t, true, y, yes}]
[--location]
[--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
[--scale-units]
[--sku {Basic, Standard}]
[--tags]
Examples
Create a Azure Bastion host machine.
az network bastion create --location westus2 --name MyBastionHost --public-ip-address MyPublicIpAddress --resource-group MyResourceGroup --vnet-name MyVnet
Required Parameters
Name of the bastion host.
Name or ID of Azure Public IP. The SKU of the public IP must be Standard.
Name of resource group. You can configure the default group using az configure --defaults group=<name>
.
Name of the virtual network. It must have a subnet called AzureBastionSubnet.
Optional Parameters
Disable copy and paste for all sessions on this Azure Bastion resource.
Enable IP-based Connections on this Azure Bastion resource.
Enable Native Client Support on this Azure Bastion resource.
Location. Values from: az account list-locations
. You can configure the default location using az configure --defaults location=<location>
.
Do not wait for the long-running operation to finish.
Scale units for the Bastion Host resource with the range of [2, 50].
SKU of this Bastion Host.
Space-separated tags: key[=value] [key[=value] ...]. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Increase logging verbosity. Use --debug for full debug logs.
az network bastion delete
This command is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Delete a Azure Bastion host machine.
az network bastion delete [--ids]
[--name]
[--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
[--resource-group]
[--subscription]
Examples
Delete a Azure Bastion host machine.
az network bastion delete --name MyBastionHost --resource-group MyResourceGroup
Optional Parameters
One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.
Name of the bastion host.
Do not wait for the long-running operation to finish.
Name of resource group. You can configure the default group using az configure --defaults group=<name>
.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Increase logging verbosity. Use --debug for full debug logs.
az network bastion list
This command is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus
List all Azure Bastion host machines.
az network bastion list [--resource-group]
Examples
List all Azure Bastion host machines.
az network bastion list -g MyResourceGroup
Optional Parameters
Name of resource group. You can configure the default group using az configure --defaults group=<name>
.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Increase logging verbosity. Use --debug for full debug logs.
az network bastion rdp
RDP to target Virtual Machine using Tunneling from Azure Bastion.
az network bastion rdp [--auth-type]
[--configure]
[--disable-gateway {false, true}]
[--enable-mfa {false, true}]
[--ids]
[--name]
[--resource-group]
[--resource-port]
[--subscription]
[--target-ip-address]
[--target-resource-id]
Examples
RDP to virtual machine using Azure Bastion.
az network bastion rdp --name MyBastionHost --resource-group MyResourceGroup --target-resource-id vmResourceId
RDP to machine using reachable IP address.
az network bastion rdp --name MyBastionHost --resource-group MyResourceGroup --target-ip-address 10.0.0.1
Optional Parameters
Auth type to use for RDP connections.
Flag to configure RDP session.
Flag to disable access through RD gateway.
Login to AAD enabled Windows machines using new protocol that authenticates using MFA if supported by target machine. Available on Windows 10 20H2+, Windows 11 21H2+, WS 2022.
One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.
Name of the bastion host.
Name of resource group. You can configure the default group using az configure --defaults group=<name>
.
Resource port of the target VM to which the bastion will connect.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
IP address of target Virtual Machine.
ResourceId of the target Virtual Machine.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Increase logging verbosity. Use --debug for full debug logs.
az network bastion show
This command is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Show a Azure Bastion host machine.
az network bastion show [--ids]
[--name]
[--resource-group]
[--subscription]
Examples
Show a Azure Bastion host machine.
az network bastion show --name MyBastionHost --resource-group MyResourceGroup
Optional Parameters
One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.
Name of the bastion host.
Name of resource group. You can configure the default group using az configure --defaults group=<name>
.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Increase logging verbosity. Use --debug for full debug logs.
az network bastion ssh
SSH to a virtual machine using Tunneling from Azure Bastion.
az network bastion ssh --auth-type
[--ids]
[--name]
[--resource-group]
[--resource-port]
[--ssh-key]
[--subscription]
[--target-ip-address]
[--target-resource-id]
[--username]
[<SSH_ARGS>]
Examples
SSH to virtual machine using Azure Bastion using password.
az network bastion ssh --name MyBastionHost --resource-group MyResourceGroup --target-resource-id vmResourceId --auth-type password --username xyz
SSH to virtual machine using Azure Bastion using ssh key file.
az network bastion ssh --name MyBastionHost --resource-group MyResourceGroup --target-resource-id vmResourceId --auth-type ssh-key --username xyz --ssh-key C:/filepath/sshkey.pem
SSH to virtual machine using Azure Bastion using AAD.
az network bastion ssh --name MyBastionHost --resource-group MyResourceGroup --target-resource-id vmResourceId --auth-type AAD
SSH to virtual machine using Azure Bastion using AAD, while supplying additional SSH arguments.
az network bastion ssh --name MyBastionHost --resource-group MyResourceGroup --target-resource-id vmResourceId --auth-type AAD -- -L 8080:127.0.0.1:8080
Required Parameters
Auth type to use for SSH connections.
Optional Parameters
One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.
Name of the bastion host.
Name of resource group. You can configure the default group using az configure --defaults group=<name>
.
Resource port of the target VM to which the bastion will connect.
SSH key file location for SSH connections.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
IP address of target Virtual Machine.
ResourceId of the target Virtual Machine.
User name for SSH connections.
Additional arguments passed to OpenSSH.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Increase logging verbosity. Use --debug for full debug logs.
az network bastion tunnel
Open a tunnel through Azure Bastion to a target virtual machine.
az network bastion tunnel --port
--resource-port
[--ids]
[--name]
[--resource-group]
[--subscription]
[--target-ip-address]
[--target-resource-id]
[--timeout]
Examples
Open a tunnel through Azure Bastion to a target virtual machine using resourceId.
az network bastion tunnel --name MyBastionHost --resource-group MyResourceGroup --target-resource-id vmResourceId --resource-port 22 --port 50022
Open a tunnel through Azure Bastion to a target virtual machine using its IP address.
az network bastion tunnel --name MyBastionHost --resource-group MyResourceGroup --target-ip-address 10.0.0.1 --resource-port 22 --port 50022
Required Parameters
Local port to use for the tunneling.
Resource port of the target VM to which the bastion will connect.
Optional Parameters
One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.
Name of the bastion host.
Name of resource group. You can configure the default group using az configure --defaults group=<name>
.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
IP address of target Virtual Machine.
ResourceId of the target Virtual Machine.
Timeout for connection to bastion host tunnel.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Increase logging verbosity. Use --debug for full debug logs.
az network bastion update
This command is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Update a Azure Bastion host machine.
az network bastion update [--add]
[--disable-copy-paste {0, 1, f, false, n, no, t, true, y, yes}]
[--enable-ip-connect {0, 1, f, false, n, no, t, true, y, yes}]
[--enable-tunneling {0, 1, f, false, n, no, t, true, y, yes}]
[--force-string {0, 1, f, false, n, no, t, true, y, yes}]
[--ids]
[--name]
[--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
[--remove]
[--resource-group]
[--scale-units]
[--set]
[--sku {Basic, Standard}]
[--subscription]
Examples
Update a Azure Bastion host machine to enable native client support.
az network bastion update --name MyBastionHost --resource-group MyResourceGroup --enable-tunneling
Optional Parameters
Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.
Disable copy and paste for all sessions on this Azure Bastion resource.
Enable IP-based Connections on this Azure Bastion resource.
Enable Native Client Support on this Azure Bastion resource.
When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.
One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.
Name of the bastion host.
Do not wait for the long-running operation to finish.
Remove a property or an element from a list. Example: --remove property.list OR --remove propertyToRemove.
Name of resource group. You can configure the default group using az configure --defaults group=<name>
.
Scale units for the Bastion Host resource with the range of [2, 50].
Update an object by specifying a property path and value to set. Example: --set property1.property2=.
SKU of this Bastion Host.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Increase logging verbosity. Use --debug for full debug logs.
az network bastion wait
Place the CLI in a waiting state until a condition is met.
az network bastion wait [--created]
[--custom]
[--deleted]
[--exists]
[--ids]
[--interval]
[--name]
[--resource-group]
[--subscription]
[--timeout]
[--updated]
Optional Parameters
Wait until created with 'provisioningState' at 'Succeeded'.
Wait until the condition satisfies a custom JMESPath query. E.g. provisioningState!='InProgress', instanceView.statuses[?code=='PowerState/running'].
Wait until deleted.
Wait until the resource exists.
One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.
Polling interval in seconds.
Name of the bastion host.
Name of resource group. You can configure the default group using az configure --defaults group=<name>
.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Maximum wait in seconds.
Wait until updated with provisioningState at 'Succeeded'.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID
.
Increase logging verbosity. Use --debug for full debug logs.