Separate Bastion shareable-link access from target-machine credentials

Source facts

A Bastion shareable link can open target-resource access without Azure credentials, but the user must authenticate to the target through RDP or SSH. The link contains no credentials; the configured target uses a username and password or private key.

The feature requires Standard SKU and does not support Virtual WAN, cross-tenant peered networks or on-premises targets. A configured expiration prevents using that link to connect after its expiry and changes its resource status to Link expired. Microsoft Learn.

Applicability

Confirm the target type, Bastion configuration and network topology. Distinguish permission to create or view links from permission to sign in to the target machine.

DSE recommendation

DSE recommends assigning ownership for both the connection link and the separate credential handoff. Use an approved secure channel for target credentials and set a link lifetime appropriate to the authorized task. Keep credential retirement and link expiration as separate checklist entries rather than assuming one action proves the other was completed.

Verification

Test with a representative authorized user who follows the link and supplies the intended target authentication. Confirm a user without valid target credentials cannot complete the sign-in. After an approved test link expires, verify a new connection through it is refused. Record the target, link status and authentication outcome without retaining passwords, private keys or a usable access link in broadly shared evidence.

Official references

Microsoft Learn: Create a shareable link for Azure Bastion. Source retrieved September 9, 2026.