Bastion: Failure to connect using native client — Connection issues with Azure Bastion and Entra ID login

MatthewBastinck-6097 0 Reputation points
2026-09-16T13:09:28.5366667+00:00

Problem description

I am experiencing issues connecting to my Windows virtual machines (VMs) via Azure Bastion using the native client with Azure Active Directory (Azure AD)/Entra ID login. When attempting to establish a connection through the Azure portal, I receive a generic connection error. This problem affects all users and all target VMs.

Environment

Azure Bastion service in the affected region, connecting to Windows VMs configured for Entra ID login, using the Azure portal/web interface.

What I've already tried

I have verified that the VM is configured for Entra ID login, with the AADLoginForWindows extension installed and system-assigned managed identity enabled. I confirmed that Bastion and the VM are in the same virtual network or properly peered, with no custom routes or forced tunneling affecting the network path. I also checked that the required Bastion security rules are in place for ports 3389, 8080, and 5701, and that Bastion provisioning completed successfully. Additionally, I verified that the VM's remote desktop services are running and that the VM listens on the correct port. I attempted to connect via the portal multiple times, using different browsers and incognito modes, but the issue persists.

Current status

I am seeking guidance on potential causes for this connection failure and recommended troubleshooting steps to resolve the issue with Azure Bastion and Entra ID login.

Azure Bastion
Azure Bastion

An Azure service that provides private and fully managed Remote Desktop Protocol (RDP) and Secure Shell (SSH) access to virtual machines.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andriy Bilous 12,191 Reputation points MVP
    2026-09-17T04:26:23.7166667+00:00

    Hello MatthewBastinck-6097

    Since the problem affects all users and all VMs, check Bastion-level configuration rather than the individual VM.

    For native RDP with Microsoft Entra ID, verify:

    Bastion is Standard SKU or higher and Native Client support/tunneling is enabled.

    Users have Virtual Machine User Login or Virtual Machine Administrator Login, plus the required Reader permissions on the VM, NIC and Bastion resource.

    The client PC is Windows 10+ and is Entra registered/joined/hybrid joined to the same tenant as the VM.

    Test the native connection directly from the local PC, not Cloud Shell:

    az network bastion rdp --name <BastionName> --resource-group <RG> --target-resource-id <VM-ID> --enable-mfa

    Also test a VM with local username/password. If that also fails, the issue is probably the Bastion/network path rather than Entra authentication.

    Check Bastion > Help > Connection Troubleshoot, and verify the AzureBastionSubnet NSG rules, VM 3389 access and client-to-Bastion HTTPS/443 path.
    Microsoft specifically notes that blocked 443/3389/8080/5701 or TLS inspection can produce the generic connection error.

    One important distinction: portal RDP and native-client RDP are different connection methods. Portal Entra RDP currently works through the browser, while native-client Entra RDP uses Azure CLI/MSTSC and requires Standard SKU plus native-client support.

    https://learn.microsoft.com/en-us/azure/bastion/native-client

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.