Azure Bastion RDP session auditing

David@WMC 21 Reputation points
2022-11-04T16:05:32.753+00:00

Hi there,
Is it possible to record all the activities for the Azure Bastion RDP session for audit purpose. According to Microsoft official documentation, I knew the Azure Bastion SSH session could record a audit log for the actions have been taken in the VM to some extent. However, it seems there's no audit trail for RDP session. Is there any solution for that purpose?

Azure Bastion
Azure Bastion
An Azure service that provides private and fully managed Remote Desktop Protocol (RDP) and Secure Shell (SSH) access to virtual machines.
249 questions
{count} votes

Accepted answer
  1. Michael Durkan 12,196 Reputation points MVP
    2022-11-04T16:12:48.003+00:00

    Hi

    you can enable diagnostic logging using Log Analytics which will record all remote session activity:

    https://learn.microsoft.com/en-us/azure/bastion/diagnostic-logs

    Thanks

    Michael Durkan

    • If the reply was helpful please upvote and/or accept as answer as this helps others in the community with similar questions. Thanks!
    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
  1. KapilAnanth-MSFT 40,911 Reputation points Microsoft Employee
    2022-11-09T07:21:41.523+00:00

    Hi @David@WMC ,

    Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
    I understand that you would like to audit the Bastion sessions.

    I see you have a follow-up question with @Michael Durkan 's answer.

    Can Azure Bastion Log Analytics log GUI activities(Windows RDP session) ?

    • As of now, Azure Bastion cannot log OS related activities.
    • Bastion works at the platform level and has a limited visibility to the OS logs/errors

    If you wish, you may vote in the below forums requesting this feature. All the feedback shared in these forums are monitored and reviewed by the Microsoft engineering teams responsible for building Azure

    Feedback Hub

    Cheers,
    Kapil

    ----------------------------------------------------------------------------------------------------------------

    Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.