Security controls around Bastian service

Question

Since Azure Bastion service is a fully managed Paas, What controls are placed around the Public IP of the Bastian Host by Microsoft? should any additional controls be placed by the Customer?
Also, what would an ideal implementation look like in terms of applied security controls in addition to Bastian Host for remote access to VM's?

Answer 1

In addition to the above shared by @David Broggy ,
You can look at this URL https://learn.microsoft.com/en-us/azure/bastion/bastion-overview to learn more about Bastion's architecture.
As a matter of best practice, Azure Bastion should be a part of well-established Landing Zone, according to the CAF or WAF frameworks, respectively.

Answer 2

Hi Banerjee,
Best security practices for using Bastion are well documented here:
bastion-security-baseline