---
title: Azure Bastion host should exist
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Azure Bastion host should exist
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Azure Bastion host should exist
 
## Description{% #description %}

Azure subscriptions should contain at least one Azure Bastion host. Azure Bastion provides RDP and SSH connectivity to virtual machines over TLS from the Azure portal. Virtual machines then do not need a public IP address, agent, or special client software. This rule fails a subscription that has no Bastion host.

## Remediation{% #remediation %}

Create a Bastion host in a virtual network that has a subnet named `AzureBastionSubnet` with a /26 or larger prefix. See [Quickstart: Deploy Azure Bastion from the Azure portal](https://learn.microsoft.com/en-us/azure/bastion/quickstart-host-portal).

## References{% #references %}

- [Quickstart: Deploy Azure Bastion from the Azure portal](https://learn.microsoft.com/en-us/azure/bastion/quickstart-host-portal)
- [What is Azure Bastion?](https://learn.microsoft.com/en-us/azure/bastion/bastion-overview)
- [az network bastion](https://learn.microsoft.com/en-us/cli/azure/network/bastion)
- [CIS Microsoft Azure Foundations Benchmark](https://www.cisecurity.org/benchmark/azure)