Context
Azure Bastion native client support lets local SSH or RDP tools reach a private VM through Bastion. A working browser session does not prove that the native capability is configured. Local tooling, Bastion features and the guest sign-in method each have separate requirements.
Collect the Bastion resource ID, VM resource ID, intended authentication method and exact local error. You need permission to inspect both resources and use the intended access path. Run native client diagnostics on the local workstation described by Microsoft's workflow rather than assuming Cloud Shell provides the same environment.
1. Check the actual Bastion capability
Inspect the deployed SKU and configuration. Native support requires Standard or Premium and an enabled native client or tunneling feature. An appropriate SKU alone does not activate every optional capability. Read effective settings rather than relying on a template that might differ from the running resource.
Confirm that the target network and connection type fit the selected architecture. Preserve the required AzureBastionSubnet rules while diagnosing access. Review resource identifiers carefully when similar Bastion and VM names exist in different environments. An apparently valid command can otherwise target an unintended deployment.
2. Separate local tools from Azure permissions
Read Azure CLI and relevant extension versions. A missing command or extension error belongs to the local toolchain, before any guest connection is attempted. Check the signed-in tenant and subscription. Apply supported extension updates through the workstation's approved software process.
Review the documented Azure permissions for Bastion, VM and networking resources. A management permission and an in-guest Linux account are different identities. Avoid broad role changes for a single denied operation. Capture the exact authorization error and resource scope without recording tokens, passwords or private keys.
3. Confirm guest authentication requirements
For Microsoft Entra sign-in, inspect the required guest login extension and the user's VM login authorization. A created tunnel can still end in guest authentication failure. With SSH-key sign-in, verify the intended username and approved public key through the normal guest access procedure.
Classify the first failure as command validation, Azure authorization, tunnel establishment or guest login. If tunneling succeeds but the port refuses connections, examine the guest listener and supported network path. Change one relevant condition at a time. A successful tunnel should not be reported as a successful administrator login.
Diagnostic checkpoints
| Stage | Likely issue | Useful evidence |
|---|---|---|
| Feature validation rejected | SKU or tunneling disabled | Bastion configuration |
| Command unavailable | Missing local support | CLI extension inventory |
| Resource operation denied | Azure permission | Operation and scope |
| Tunnel opens, login fails | Guest authentication | Extension and account |
Illustrative scenario
A hypothetical administrator can connect in the portal but receives a native-feature error locally. The host is Standard, yet tunneling remains disabled. After the reviewed feature change, the tunnel opens and exposes a separate username mismatch. This example illustrates successive boundaries and makes no claim about a real access incident.
Verification and access SOP
Verify login with the intended method and exact VM resource ID. Confirm the expected hostname, close the session and repeat from a clean client process. Check file transfer separately if required because connection types have different supported capabilities.
Maintain workstation prerequisites, resource permissions and supported authentication choices in the access SOP. Monitor Bastion access events alongside guest sign-in failures. Review feature limitations before changing SKU or promising session recording for native connections. Retest the intended workflow after workstation tooling or guest authentication changes, so a browser-only check does not conceal a native client regression.
Explore Clouvenix cloud security for implementation and operational handover.