DEPLOYING SECURE VMs THAT CAN BE ACCESSED ONLY THROUGH NSG RULE + AZURE BASTION

Ezekiel Olaniyan — Thu, 27 Aug 2026 14:09:05 +0000

*DEPLOYING SECURE VMs THAT CAN BE ACCESSED ONLY THROUGH NSG RULE + AZURE BASTION WITHOUT EXPOSURE TO THE INTERNET. *

Architectural Drawing of VM Using Bastion and NSG

Step One: Sign in to the Azure Portal and create a new Resource Group as shown below:

Type Resource Group in the search box and select it as indicated in the screenshot.
Click on “Create” in the Resource Group window.
Enter the Resource Group name and select your preferred region.
Finally, click on “review and create” to create the Resource Group .

Step Two: Create Virtual Network.

Search for Virtual Network by typing it in the search box as indicated in the screenshot below, and select Virtual Network.
On the virtual Network page, click on “Create”.
Select your Resource Group and enter your Virtual Network name, then click on next.
Under the Address space, confirm your CIDR range then review and create.
Finally, click on “Create” to create your Virtual Network.

**Step Three (3): Create Subnets.
**For this project, two subnets are required; the main subnet and the Azure Bastion subnet.

To create the main subnet, click on the virtual network you have created, then search for “Subnets” in the search box and select it as shown in the screenshot below
On the “Add Subnets” page, input your subnet name then click on “Add” as shown below.

*Create Azure Bastion-Subnet. *

To create the Azure Bastion subnet, Under the “Add a subnet” page, click on Subnets.
Select Azure Bastion for Subnet purpose as shown in the screenshot.
Finally, click on Add to create your Azure Bastion subnet.

STEP FOUR (4): Create Azure Bastion.

Type Bastions in the search box and select Bastions as indicated in the screenshot.
Click on Create on the Bastions page.
On the Add a Bastion page, select your Resource group, enter your Bastion name and indicate the desired instance count as shown in the screenshot.
Click on Review and create, then “Create” to create your Bastion.

STEP FIVE (5): Create Virtual Machine.

To spin up any virtual machine type “Virtual machines” in the search box as indicated in the screenshot, then select Virtual machines. On the “Compute Infrastructure” page, under virtual machine click on create and select Virtual machine as shown in the screenshot below
On the Create a Virtual machine page, select your Resource group, enter your virtual machine name, select your desired zone, then click on “Next: Disk” as indicated below.
On the next page select your desired availability zone. For windows VM select desired Windows image, architecture and size as shown in the screenshot, then click on Next: Disk
For Windows VM enter the username, password, and confirm password, then click on next: disk
Next, select your virtual network and subnet. For public IP select None, for NIC select Basic and for Public inbound port select None as shown in the screenshot.
Finally, click on review and create, then create.

For Linux VM select desired Ubuntu image, architecture and size as shown in the screenshot, then click on Next: Disk
Select SSH public key, input username, generate keypair, select RSA SSH format, then click on Next: Disk as shown below.
For public inbound port, select None as shown below, then click on Next: Disk
Next, select your virtual network and subnet. For public IP select None, for NIC select Basic and for Public inbound port select None as shown in the screenshot.
Finally, click on review and create, then create

Create a Network Security Group (NSG) for port 3389.

To create NSG, click on the Windows virtual machine, scroll down and click on Networking.
Select Network settings as indicated in the screenshot below.
Click on Create port rule as indicated in the screenshot, then Inbound port rule.
Under “Add security rule” select “Any” for source, select “asterisk” for source port ranges, “Any” for destination, and “RDP” for service and 3389 for destination port ranges as shown below. For Linux VM, select SSH for service and 22 for destination port ranges.
Select TCP for protocol, for Action select “Allow”, for priority select “100”

Connecting to the secure VM via Bastion using SSH Port 22.

Open the virtual machine, then click on connect.
Click on connect via Bastion
Click on Bastion, then select SSH.
Enter your username, keypair (from your download folder) and password. And connect.

Connecting to the secure VM via Bastion using RDP Port 3389.

HOW TO CREATE USER AND ASSIGN ROLES IN AZURE WITH ENTRA ID

Ezekiel Olaniyan — Sat, 23 May 2026 11:02:49 +0000

To create user in Azure using Entra ID, begin by typing Entra ID in the search box and select entra ID from the list of items as shown below

Next, click on "User" as indicated in the image below. This takes you to a new page where you click on "New user".

Select "Create new user", then input the principal name, display name and click on Next: properties. Fill the required information on the properties page, then click on Next: Assignment. On the assignment page, click on "Add Role" and select the desired role from the list of roles on the right hand side of the pane as shown below

Click on Next: Review + Create, then Create. You may need to refresh the new page for the changes made to reflect and for the newly created user to appear in the list of users created.

DEV Community: Ezekiel Olaniyan

DEPLOYING SECURE VMs THAT CAN BE ACCESSED ONLY THROUGH NSG RULE + AZURE BASTION

HOW TO CREATE USER AND ASSIGN ROLES IN AZURE WITH ENTRA ID