Azure VM suddenly stopped accepting SSH connections through Bastion

Daniel Madrigal Diaz 90 Reputation points Microsoft Employee
2026-07-21T22:11:27.01+00:00

We were previously able to connect successfully to this VM through Azure Bastion using Microsoft Entra ID authentication. The VM suddenly stopped accepting SSH connections without an intentional configuration change on our side.

**
Service:** Azure Virtual Machines / Azure Bastion

VM size: Standard_ND128isr_GB300_v6

Impact started: July 21, 2026

We use the following command to ssh:

az network bastion ssh `
  --name <BASTION_NAME> `
  --resource-group <RESOURCE_GROUP> `
  --target-resource-id <VM_RESOURCE_ID> `
  --auth-type AAD

The Entra SSH certificate is generated successfully, and the Bastion tunnel initially reports a connection. The connection is then forcibly reset:

Generated SSH certificate [REDACTED] is valid until [REDACTED].
Got a connection, starting a new thread
Exception in handling client: ('Connection aborted.',
ConnectionResetError(10054, 'An existing connection was forcibly closed by the remote host',
None, 10054, None))
Both debugger and websocket threads stopped...
Stopped local server.

We also attempted to execute diagnostic commands using Run command from the VM page in the Azure portal. Although Azure reports that the VM is running, it does not respond to these commands and no useful guest-level output is returned. This suggests that the problem is not limited to Bastion or SSH and may involve the guest operating system, Azure VM Agent, host, or underlying platform.

Azure Virtual Machines
Azure Virtual Machines

An Azure service that is used to provision Windows and Linux virtual machines.

0 comments
Answer accepted by question author

AI answer

2026-07-21T22:11:56.2733333+00:00

The symptoms point to a guest or VM health issue, not just a Bastion authentication problem:

  1. Treat the VM as potentially unhealthy first Since Run command is not returning useful output, check whether the VM agent is healthy. In the Azure portal, go to Virtual Machines > affected VM > Settings > Properties and verify Agent Status is Ready. If the agent is not healthy, guest-side diagnostics and Bastion sessions can both fail.
  2. Check boot state from the platform side In the Azure portal, open Virtual Machines > affected VM > Help > Boot diagnostics.
    • Review the Screenshot to confirm the OS is actually booted and not stuck.
    • Review the Serial log for boot or kernel errors. This helps distinguish a networking problem from an OS or host problem.
  3. Use Bastion Connection Troubleshoot In the Azure portal, open the Azure Bastion resource, then go to Help > Connection Troubleshoot. Run a TCP check to the VM.
    • If the path is reachable, the issue is likely inside the guest OS: SSH service, SSH port listening state, firewall, disk-full condition, or Entra sign-in configuration.
    • If the path is not reachable, investigate NSGs, routing, or Bastion-to-VM connectivity.
  4. Validate the SSH service and port on the VM For Linux VMs, the documented checks are:
    • SSH daemon must be active.
    • Port 22 must be listening, unless SSH was intentionally moved to a custom port.
    • iptables or firewalld must not be blocking SSH.
    • OS disk usage must not be full. If diagnostics show the SSH daemon is inactive, port 22 is not listening, firewall rules block SSH, or disk usage is at 100%, Bastion SSH sessions can fail even when the tunnel initially opens.
  5. Check whether Microsoft Entra login on the VM is still valid For --auth-type AAD, the target VM must have Microsoft Entra login enabled with the correct VM extension:
    • AADSSHLoginForLinux for Linux If the extension is stuck in Transitioning, documented causes include:
    • missing system-assigned managed identity
    • older AADLoginForLinux extension still installed Also verify the user still has either Virtual Machine Administrator Login or Virtual Machine User Login at the VM scope. Without that role assignment, sign-in can fail after Azure authentication succeeds.
  6. Confirm Bastion prerequisites for native client + AAD For az network bastion ssh:
    • Bastion must be Standard SKU or higher
    • Native Client support (tunneling) must be enabled on the Bastion host
    • Local Azure CLI must have both the bastion and ssh extensions installed If these prerequisites were missing, the command would normally fail earlier, but they should still be verified.
  7. If the VM appears unhealthy, use recovery actions carefully If Boot diagnostics or Serial log suggests the guest is hung or not booting correctly:
    • Try Restart first.
    • If still failing, use Redeploy + reapply to move the VM to a fresh Azure host while preserving disks.
    • Before any risky recovery work, create snapshots of the OS disk and any data disks.
  8. Most likely interpretation for this specific pattern Because:
    • the Entra SSH certificate is generated,
    • the Bastion tunnel initially connects,
    • then the connection is reset,
    • and Run command is also not responding,
    the strongest documented next checks are:
    • VM agent health
    • Boot diagnostics / Serial log
    • Bastion Connection Troubleshoot
    • guest SSH daemon / port / firewall / disk state
    • AADSSHLoginForLinux extension health and managed identity

If all guest health checks look normal and the VM remains reachable but Bastion SSH still resets, the documented next step is to file an Azure support request.

References:

AI-generated content may be incorrect. Read our transparency notes for more information.

Was this answer helpful?

1 person found this answer helpful.

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Daniel Madrigal Diaz 90 Reputation points Microsoft Employee
    2026-07-28T20:45:16.2733333+00:00

    The issue was caused by an unhealthy Bastion instance. Recreating the Bastion resolved the connection problem.

    Was this answer helpful?

    0 comments
  2. Jose Benjamin Solis Nolasco 12,281 Reputation points Volunteer Moderator
    2026-07-22T00:38:50.6566667+00:00

    Welcome to Microsoft Q&A

    Hello @Daniel Madrigal Diaz , I hope you are doing well.

    Based on the symptoms, this does not appear to be an Azure Bastion authentication issue. Since the Entra SSH certificate is generated successfully and the connection is initially established, but the remote host then forcibly resets the connection, the issue may be at the VM/guest OS level.

    I recommend checking the following:

    • Verify the VM's Boot Diagnostics and Serial Console to determine whether the guest OS is responsive.
    • Check whether the Azure VM Agent is healthy. The fact that Run Command is also not returning output is an important indicator that the issue may extend beyond SSH.
    • If possible, check the VM's guest OS logs for SSH or network-related errors.
    • Review the VM's Activity Log and Resource Health for any platform or host events around July 21.
    • If the VM is unresponsive at the guest level, consider a Restart or Redeploy operation, depending on your workload and recovery requirements. A redeploy moves the VM to a new Azure host but should be planned carefully.

    Because both Bastion SSH and Run Command appear affected, I would first focus on determining whether the guest OS and VM Agent are responsive before troubleshooting Bastion itself.

    References

    If my answer helped you, please consider marking it as accepted. This helps others in the community find similar solutions.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.