# Azure Bastion

This tutorial explains what is and how to create a Bastion in Azure.

In the case where a Virtual Machine, created in a VNet/subnet has no public IP that machine is not accessible from the Internet to connect to it directly. In this situation Azure Bastion comes in handy.

Azure Bastion protects your virtual machines by providing lightweight, browser-based connectivity without the need to expose them through public IP addresses. Deploying will automatically create a Bastion host on a subnet in your virtual network.

Supposing we have this situation where no VM has a Public IP:

In this case, you cannot access any of these 2 VMs.

For creating a Bastion we can go to VNet ("Main-VNet1" in my case).

Click on "Bastion".

Click on "Deploy Bastion".

After a while, the Bastion is created (in a new Subnet):

If we want ot connect to a VM in this VNet, we can click on "Bastion".

Complete with the information demanded and click on "Connect" and you will be connected to that VM: