Azure DevTest Labs integrates withAzure Bastion to allow connecting to lab virtual machines (VMs) through a browser. When a lab owner enables browser access to lab VMs through Bastion, lab users can connect to their VMs through their browsers without needing any other client, agent, or software.

Azure Bastion provides secure and seamless remote desktop protocol (RDP) and secure shell (SSH) connectivity over transport layer security (TLS), directly from the Azure portal. Lab VMs don't need public IP addresses.

This article covers two ways to enable Azure Bastion browser connectivity to DevTest Labs VMs:

• Create a new Azure Bastion-enabled virtual network for your lab
• Deploy Azure Bastion in your existing lab virtual network

Prerequisites

• To enable and configure Azure Bastion for a lab, you needOwner orContributor role in the lab.
• To connect to an Azure Bastion-enabled lab virtual machine (VM) through a browser, you need ownership access to the VM and at leastDevTest Labs User role in the lab.

For more information about DevTest Labs user roles and access, seeAdd and configure lab users.

Option 1: Create a new Azure Bastion-enabled virtual network

You can create a new virtual network for your lab with an Azure Bastion subnet and another subnet in it. An Azure Bastion subnet allows only Bastion resources in it, so you use the other subnet for creating lab VMs.

1. In the Azure portal, search for and selectvirtual networks.

2. SelectCreate at the top of theVirtual networks page.

3. On theCreate virtual network page, enter aName for the new virtual network, and select the sameSubscription,Resource group, andRegion as your lab.

4. SelectNext or theSecurity tab.

5. On theSecurity page, underAzure Bastion, select theEnable Azure Bastion checkbox. Accept or configure the values in theAzure Bastion host name andAzure Bastion public IP address fields.

   

6. SelectNext or theIP Addresses tab.

7. On theIP Addresses page, ensure there are two subnets nameddefault andAzureBastionSubnet, and configure IP address ranges if necessary.

   

8. SelectReview + create, and when validation passes, selectCreate.

9. Once the new virtual network is created, go to its page, selectSubnets in the left navigation, and confirm that there are two subnets,default andAzureBastionSubnet.

   

Connect your lab to the new virtual network

Follow these instructions to connect your lab to the new Azure Bastion-enabled virtual network.

1. From your labOverview page, selectConfiguration and policies in the left navigation.

2. On theConfiguration and policies page, in the left navigation underExternal resources, selectVirtual networks.

3. On theVirtual networks page, selectAdd.

4. On theVirtual network page, selectSelect virtual network.

5. On theChoose virtual network page, select the Azure Bastion-enabled virtual network you created.

6. On theVirtual network page, selectSave.

7. On theVirtual networks page, remove any previous virtual network from the lab. Select... next to that virtual network, selectDelete, and then selectYes.

   

Enable VM creation in the default subnet

Follow these instructions to enable VM creation in the default subnet of the new virtual network.

1. On theVirtual networks page, select the Azure Bastion-enabled virtual network.

2. On theVirtual network page, make sure that both theAzureBastionSubnet subnet and thedefault subnet appear, and select thedefault subnet.

3. On theLab Subnet pane, selectYes underUse in virtual machine creation, and then selectSave. You can now create VMs in the default subnet of your lab virtual network.

   

Option 2: Deploy Azure Bastion in the existing lab virtual network

You can enable browser connections to existing lab VMs by creating a new Azure Bastion subnet in your lab's existing virtual network.

1. On your labOverview page, selectConfiguration and policies from the left navigation.

2. On theConfiguration and policies page, selectVirtual networks underSettings in the left navigation.

3. Select your lab's existing virtual network, and on the virtual network's page, selectOpen Virtual Network Blade.

4. On the virtual network's page, selectBastion underSettings in the left navigation.

5. On theBastion page, if necessary, add a new address range that's within the virtual network's address space, but doesn't overlap with the existing lab subnet.

6. SelectDeploy Bastion.

   

Enable connections through Azure Bastion

Once you deploy Azure Bastion in a new or existing lab virtual network, enable browser connections for the lab.

1. On the labOverview page, selectConfiguration and policies, and then selectConnect via Bastion underSettings in the left navigation.

2. On theConnect via Bastion page, setConnect via Bastion toOn, and then selectSave.

   

Connect to lab VMs through Azure Bastion

To connect to a Bastion-enabled lab VM:

1. On the labOverview page, select the lab VM fromMy virtual machines.
2. At the top of the VM's page, selectConnect >Connect via Bastion.
3. In theBrowser connect pane, enter your VM's username and password, and selectConnect.

For more information, seeConnect to lab VMs in a browser via Azure Bastion.

Related content

• Azure Bastion documentation
• What is Azure Bastion?
• Add a VM to your lab