Azure Bastion Developer SKU: Secure Access, Free by Default
Azure Bastion Developer gives you no-public-IP RDP/SSH access to one VM for $0/hour. Microsoft made the secure path the free path. Here's what it does, its real limits, and how it compares.
You’ve got one dev VM. It needs RDP or SSH access once in a while. The old default was a public IP on that VM and an NSG rule you keep meaning to tighten. Azure Bastion Developer SKU gives you a better default instead: no public IP, browser-based RDP/SSH, and it’s free.
I like that Microsoft built this. Making the secure path the free, zero-setup path is exactly the kind of default that actually changes behavior, instead of just publishing a best-practices doc nobody reads. It’s also genuinely limited, on purpose, and that’s worth understanding before you build around it.
What it actually is
Bastion Developer is a shared, always-on Bastion instance Microsoft runs on your behalf. You don’t deploy a dedicated host, you don’t carve out an AzureBastionSubnet, and you don’t attach a public IP to anything. You pick a VM in the portal’s Connect blade, click Bastion, and you’re in over RDP or SSH.
It reached general availability in May 2024, after a public preview that started in October 2023. It launched in a small set of regions, not the full list Bastion normally supports, so check the region list before you plan around it.
The limits that actually matter
This is the part people skip past, and it’s the part that decides whether Developer SKU works for you.
- One VM connection at a time. Not one session per user, one connection total for the whole shared instance backing that VM. Two people can’t hop on two different VMs through Developer SKU simultaneously and expect it to behave like a dedicated deployment.
- No virtual network peering. Developer SKU only reaches VMs in the same VNet it’s deployed into. If your VM sits behind a hub-and-spoke topology, this SKU doesn’t cross that boundary.
- No native client, no custom ports, no IP-Connect, no shareable links. Those are Standard and Premium features. Developer SKU is portal-only, browser-only.
- Microsoft says it plainly: not for production. That’s not a soft suggestion. There’s no dedicated capacity behind it, so there’s no concurrency and no SLA story that matches a production workload.
None of that is a knock on the SKU. It’s the right shape for a free, shared resource: narrow enough to protect the capacity behind it, wide enough to solve the actual problem most solo devs and small teams have.
Who this is actually for
- A solo dev or small team with one or two dev/test VMs that need occasional RDP/SSH and nothing else.
- A home lab or a proof-of-concept environment where standing up a dedicated Bastion host for a single VM would be silly money for silly usage.
- Anyone who currently manages that access with a jump box, a public IP, and an NSG rule they’ve been meaning to tighten “eventually.”
The four SKUs, side by side
| Developer | Basic | Standard | Premium | |
|---|---|---|---|---|
| Price | Free | $0.19/hr (~$137/mo) | $0.29/hr (~$209/mo) | $0.45/hr (~$324/mo) |
| Deployment | Shared, zero setup | Dedicated | Dedicated | Dedicated |
| VNet peering | No | Yes | Yes | Yes |
| Concurrent connections | 1 per VM | Fixed at 2 instances | Scales 2-50 | Scales 2-50 |
| Native client | No (browser only) | No | Yes | Yes |
| Session recording | No | No | No | Yes |
| Production ready | No | Yes | Yes | Yes |
If you can already picture VNet peering or a second concurrent user in your near future, don’t build a habit around Developer SKU. Plan the upgrade now, because downgrading later isn’t supported. Moving up means creating an AzureBastionSubnet (/26 or larger) and a public IP for the dedicated SKU, and that’s roughly a 10-minute cutover, not a redesign.
What it’s really replacing
The comparison that matters most isn’t Developer versus the paid Bastion tiers. It’s Developer versus the DIY jump box it’s meant to replace. A Standard_B2s Linux VM alone runs about $30/month in East US at $0.0416/hour. Add a Standard static public IP at $0.005/hour (about $3.65/month) and a managed disk, and you’re at $35-40/month in Azure resources before you’ve spent an hour hardening NSG rules, patching the box, or explaining to an auditor why you have a VM with a public IP whose entire job is being an open door to other VMs.
Developer SKU beats that on cost, because it’s free, and it beats it on security, because there’s no public IP anywhere in the picture. That’s a genuinely good trade, and it’s the one most solo devs and small teams are actually making.
Bottom line
Developer SKU isn’t a cheaper Bastion. It’s Microsoft making secure-by-default the path of least resistance: zero cost, zero setup, and the public-IP-on-a-jump-box pattern has one less excuse to exist. That’s a good move, and more of Azure’s defaults could stand to work this way.
It’s also scoped on purpose, not accidentally. The moment you need a second concurrent connection, a peered VNet, or anything resembling production, you’re upgrading to Basic, Standard, or Premium. That’s fine. Just know which one you’ll need before you’re mid-incident finding out Developer SKU was never going to cover it.
Subscribe for more of these.