azureazure-bastion

Is audit logging possible on Azure Bastion Developer tier?

We have just started to use Azure Bastion with the free Developer tier. We use it to securely connect to a VM that runs in a private vNet. This all works perfectly fine and we can connect to the VM just fine.

However, I would like to find a way to be able to find who connected to the VM, and when.

I have tried to enable Diagnostic Settings as in the screenshot below. But nothing appears in the Log Analytics Workspace that I link to it or the Storage Account that I link to it.

Azure Diagnostics screenshot

Is it simply not possible? I have not been able to find in the documentation that it is not possible, but I suspect it might be. Again, I'm asking for Developer tier.

Thanks in advance.

Solution

  • AFAIK, The bastion Developer tier is not supporting Bastion Audit Logs to check the detailed logs about who connected and when.

    Initially, I tried using the Bastion Developer tier and enabled boot diagnostics with a Log Analytics workspace to check the logs for who connected and when. I performed activities such as connecting to and disconnecting from the virtual machine multiple times using the Bastion service to record the activity.

    enter image description here

    But unfortunately, I'm unable to see the logs in the Azure Log Analytics workspace.

    enter image description here

    Then, I upgraded my Bastion service to the 'Basic' tier by navigating to the configuration of Bastion. enter image description here

    After that, I enabled boot diagnostics in the Bastion service and selected the Log Analytics workspace. I performed activities like connecting to the Virtual Machine using the Bastion service, waited for some time, and checked the logs in the Log Analytics workspace. I was able to see information about who connected and when. I used the below Kusto query to fetch the details.

    MicrosoftAzureBastionAuditLogs 
| where OperationName == "Microsoft.Network/BastionHost/connect"
| project Time,OperationName,UserName,ClientIpAddress,UserEmail,Message

    Output:

    enter image description here

    enter image description here

    Reference: Introducing Azure Bastion Developer: Secure and cost-effective access to your Azure Virtual Machines | Microsoft Azure Blog