Azure Arc Bastion

Hello Handian, thanks for reaching out! I ran into the same thing when I first onboarded on-prem/Arc-registered VMs—under the “Connect” blade you only get “Connect with SSH,” even on Windows machines. That’s because:

• Azure Bastion is a PaaS service you deploy into an Azure Virtual Network; it only knows how to RDP/SSH into VMs that have a private IP on that VNet

• Arc-enabled servers, by default, are external resources (on-prem, other clouds, Azure Stack HCI) and don’t live inside your Azure VNet, so Bastion can’t see or route to them

• The Arc connected-machine agent exposes an SSH channel for management, which is why you see SSH for every Arc VM

If you want RDP over Bastion into your Arc-managed Windows boxes you currently need to deploy the Arc Proxy/Gateway service (gated preview) or use the new Bastion extension for Arc machines, which will bridge Bastion into your on-prem hosts. Until that preview capability is enabled in your tenant, Bastion won’t show up as a connection option for Arc VMs.

Hope that explains why you only see SSH—for now that’s expected behavior with Arc. Let me know if you want details on the Arc Proxy/Gateway preview!

References

• Azure Bastion overview & connection methods

• Azure Arc–enabled servers doc:

In an Azure Local environment, Windows VMs that are Azure Arc–enabled expose connectivity through Arc SSH, not Azure Bastion. This is why only Connect with SSH is shown in the Azure portal for those machines, even if the guest OS is Windows.

For Azure Local VMs, the supported pattern is:

1. Install the OpenSSH Server extension on the Windows VM via Azure Arc (either from Extensions in the portal or using az connectedmachine extension create).
2. Use Arc SSH from the Azure CLI to connect:

      az ssh arc --resource-group <resourceGroup> --name <serverName> --local-user <localUser>
   

3. If an RDP session is needed, use RDP over SSH (Windows VMs only):

      az ssh arc --resource-group <resourceGroup> --name <serverName> --local-user <localUser> --rdp
   

Azure Bastion’s native client integration (az network bastion ssh) is documented for Azure VMs, not for Azure Local/Arc-enabled VMs. For Azure Local, remote access is provided via Arc SSH and RDP-over-SSH instead of a Bastion “Connect” button in the portal.

References:

• Connect to an Azure Local VM using SSH, RDP over SSH, or VM Connect (preview)
• Connect to an Azure Local VM via SSH for multi-rack deployments (preview)
• Connect to a VM using Bastion and the Windows native client