Azure Bastion Developer: What NSG source should allow TCP 3389 to the target VM?

In short, Azure Bastion Developer SKU injects its traffic into your Virtual Network using the standard Azure platform management IP address, 168.63.129.16, or through the broader VirtualNetwork service tag. Because it uses a multi-tenant shared-pool infrastructure instead of a dedicated, isolated AzureBastionSubnet inside your VNet, it behaves differently at the network security group (NSG) layer. Microsoft Learn: Azure Bastion NSG guidance

Unlike the dedicated Basic, Standard, and Premium SKUs, where you scope the inbound rule source specifically to your private AzureBastionSubnet CIDR block, the Developer SKU uses shared Azure platform infrastructure. Microsoft Learn: Azure Bastion NSG guidance

The NSG source for the Developer SKU can be configured as the Azure platform IP address 168.63.129.16. To achieve a least-privilege configuration, you'd create an inbound security rule on the target VM's NSG specifying 168.63.129.16 as the source.

VirtualNetwork is also a supported source and allows the traffic to pass. However, VirtualNetwork encompasses the virtual network and connected network spaces represented by the service tag, so it is broader than specifying the individual platform IP address.

The least-privilege inbound rule can be configured with a source type of IP Addresses, a source IP address of 168.63.129.16, any source port, the private IP address or application security group representing the target Windows VM as the destination, TCP as the protocol, destination port 3389 for RDP, and Allow as the action.

If you have custom NSG rules that deny relevant Azure platform or VirtualNetwork traffic, those rules can prevent the Developer SKU connection from reaching the target VM. NSG rules are evaluated according to priority, so an explicit allow rule must have a higher priority than a conflicting deny rule.

The networkAcls.ipRules property on the Bastion resource controls operator or client access to the Azure Bastion service itself. It establishes an ingress security boundary for client connections to the Bastion service and is separate from the traffic that Bastion subsequently sends toward the target VM.

The property can be used to restrict which client public IP addresses are permitted to connect to the Bastion service. Restricting these addresses limits access to trusted corporate egress addresses or administrative workstations. It does not determine the source address used by Bastion when establishing the connection to the target VM.

Microsoft documents the Developer SKU as a lightweight Bastion option intended for development, testing, and other scenarios where the full capabilities of the dedicated Bastion SKUs are not required. The Developer SKU does not require a dedicated AzureBastionSubnet in the virtual network. Microsoft Learn: Azure Bastion Developer SKU

Note that the Developer SKU does not provide the same dedicated subnet architecture as the other Bastion SKUs, so if you require a dedicated AzureBastionSubnet boundary for your network security, you should use a Bastion SKU that provides that architecture.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin