Bastion Hosts - Create Or Update

Service:
Virtual Networks
API Version:
2026-01-01

Creates or updates the specified Bastion Host.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/bastionHosts/{bastionHostName}?api-version=2026-01-01

URI Parameters

Name In Required Type Description
bastionHostName
 path True

string

The name of the Bastion Host.
resourceGroupName
 path True

string

minLength: 1
maxLength: 90

The name of the resource group. The name is case insensitive.
subscriptionId
 path True

string (uuid)

The ID of the target subscription. The value must be an UUID.
api-version
 query True

string

minLength: 1

The API version to use for this operation.

Request Body

Name Type Description
id

string

Resource ID.
identity

ManagedServiceIdentity

The identity assigned to the Bastion Host resource
location

string

Resource location.
properties.disableCopyPaste

boolean

Enable/Disable Copy/Paste feature of the Bastion Host resource.
properties.dnsName

string

FQDN for the endpoint on which bastion host is accessible.
properties.enableFileCopy

boolean

Enable/Disable File Copy feature of the Bastion Host resource.
properties.enableIpConnect

boolean

Enable/Disable IP Connect feature of the Bastion Host resource.
properties.enableKerberos

boolean

Enable/Disable Kerberos feature of the Bastion Host resource.
properties.enablePrivateOnlyBastion

boolean

Enable/Disable Private Only feature of the Bastion Host resource.
properties.enableSessionRecording

boolean

Enable/Disable Session Recording feature of the Bastion Host resource.
properties.enableShareableLink

boolean

Enable/Disable Shareable Link of the Bastion Host resource.
properties.enableTunneling

boolean

Enable/Disable Tunneling feature of the Bastion Host resource.
properties.ipConfigurations

BastionHostIPConfiguration[]

IP configuration of the Bastion Host resource.
properties.networkAcls

BastionHostPropertiesFormatNetworkAcls

properties.scaleUnits

integer (int32)

minimum: 2
maximum: 50

The scale units for the Bastion Host resource.
properties.sessionRecordingConfiguration

BastionSessionRecordingConfiguration

The storage account and identity to use for session recording
properties.virtualNetwork

SubResource

Reference to an existing virtual network required for Developer Bastion Host only.
sku

Sku

The sku of this Bastion Host.
tags

object

Resource tags.
zones

string[]

A list of availability zones denoting where the resource needs to come from.

Responses

Name Type Description
200 OK

BastionHost

Resource 'BastionHost' update operation succeeded
201 Created

BastionHost

Resource 'BastionHost' create operation succeeded

Headers

  • Azure-AsyncOperation: string
  • Retry-After: integer
Other Status Codes

CloudError

An unexpected error response.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

Create Bastion Host
Create Bastion Host With Private Only
Create Bastion Host With Zones
Create Developer Bastion Host
Create or Update Bastion Host With System Assigned Identity for Session Recording Configuration
Create or Update Bastion Host With User Assigned Identity for Session Recording Configuration

Create Bastion Host

Sample request

PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant?api-version=2026-01-01

{
  "properties": {
    "ipConfigurations": [
      {
        "name": "bastionHostIpConfiguration",
        "properties": {
          "publicIPAddress": {
            "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
          },
          "subnet": {
            "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/BastionHostSubnet"
          }
        }
      }
    ]
  }
}

Sample response

Status code:
200 
{
  "name": "bastionhost",
  "type": "Microsoft.Network/bastionHosts",
  "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant'",
  "location": "West US",
  "properties": {
    "disableCopyPaste": false,
    "dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
    "enableIpConnect": false,
    "enableKerberos": false,
    "enablePrivateOnlyBastion": false,
    "enableSessionRecording": false,
    "enableShareableLink": false,
    "enableTunneling": false,
    "ipConfigurations": [
      {
        "name": "bastionHostIpConfiguration",
        "type": "Microsoft.Network/bastionHosts/bastionHostIpConfigurations",
        "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
        "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant/bastionHostIpConfigurations/bastionHostIpConfiguration",
        "properties": {
          "privateIPAllocationMethod": "Dynamic",
          "provisioningState": "Succeeded",
          "publicIPAddress": {
            "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
          },
          "subnet": {
            "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/BastionHostSubnet"
          }
        }
      }
    ],
    "provisioningState": "Succeeded",
    "scaleUnits": 2
  },
  "sku": {
    "name": "Standard"
  }
}
Status code:
201 
{
  "name": "bastionhosttenant'",
  "type": "Microsoft.Network/bastionHosts",
  "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant",
  "location": "West US",
  "properties": {
    "disableCopyPaste": false,
    "dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
    "enableIpConnect": false,
    "enableKerberos": false,
    "enablePrivateOnlyBastion": false,
    "enableSessionRecording": false,
    "enableShareableLink": false,
    "enableTunneling": false,
    "ipConfigurations": [
      {
        "name": "bastionHostIpConfiguration",
        "type": "Microsoft.Network/bastionHosts/bastionHostIpConfigurations",
        "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
        "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant/bastionHostIpConfigurations/bastionHostIpConfiguration",
        "properties": {
          "privateIPAllocationMethod": "Dynamic",
          "provisioningState": "Succeeded",
          "publicIPAddress": {
            "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
          },
          "subnet": {
            "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/BastionHostSubnet"
          }
        }
      }
    ],
    "provisioningState": "Succeeded",
    "scaleUnits": 2
  },
  "sku": {
    "name": "Standard"
  }
}

Create Bastion Host With Private Only

Sample request

PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant?api-version=2026-01-01

{
  "properties": {
    "enablePrivateOnlyBastion": true,
    "ipConfigurations": [
      {
        "name": "bastionHostIpConfiguration",
        "properties": {
          "subnet": {
            "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/BastionHostSubnet"
          }
        }
      }
    ]
  }
}

Sample response

Status code:
200 
{
  "name": "bastionhosttenant",
  "type": "Microsoft.Network/bastionHosts",
  "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant",
  "location": "West US",
  "properties": {
    "disableCopyPaste": false,
    "dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
    "enableIpConnect": false,
    "enableKerberos": false,
    "enablePrivateOnlyBastion": true,
    "enableSessionRecording": false,
    "enableShareableLink": false,
    "enableTunneling": false,
    "ipConfigurations": [
      {
        "name": "bastionHostIpConfiguration",
        "type": "Microsoft.Network/bastionHosts/bastionHostIpConfigurations",
        "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
        "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant/bastionHostIpConfigurations/bastionHostIpConfiguration",
        "properties": {
          "privateIPAllocationMethod": "Dynamic",
          "provisioningState": "Succeeded",
          "subnet": {
            "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/BastionHostSubnet"
          }
        }
      }
    ],
    "provisioningState": "Succeeded",
    "scaleUnits": 2
  },
  "sku": {
    "name": "Premium"
  }
}
Status code:
201 
{
  "name": "bastionhosttenant",
  "type": "Microsoft.Network/bastionHosts",
  "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant",
  "location": "West US",
  "properties": {
    "disableCopyPaste": false,
    "dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
    "enableIpConnect": false,
    "enableKerberos": false,
    "enablePrivateOnlyBastion": true,
    "enableSessionRecording": false,
    "enableShareableLink": false,
    "enableTunneling": false,
    "ipConfigurations": [
      {
        "name": "bastionHostIpConfiguration",
        "type": "Microsoft.Network/bastionHosts/bastionHostIpConfigurations",
        "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
        "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant/bastionHostIpConfigurations/bastionHostIpConfiguration",
        "properties": {
          "privateIPAllocationMethod": "Dynamic",
          "provisioningState": "Succeeded",
          "subnet": {
            "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/BastionHostSubnet"
          }
        }
      }
    ],
    "provisioningState": "Succeeded",
    "scaleUnits": 2
  },
  "sku": {
    "name": "Premium"
  }
}

Create Bastion Host With Zones

Sample request

PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant?api-version=2026-01-01

{
  "properties": {
    "ipConfigurations": [
      {
        "name": "bastionHostIpConfiguration",
        "properties": {
          "publicIPAddress": {
            "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
          },
          "subnet": {
            "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/BastionHostSubnet"
          }
        }
      }
    ]
  }
}

Sample response

Status code:
200 
{
  "name": "bastionhost",
  "type": "Microsoft.Network/bastionHosts",
  "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant'",
  "location": "West US",
  "properties": {
    "disableCopyPaste": false,
    "dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
    "enableIpConnect": false,
    "enableKerberos": false,
    "enablePrivateOnlyBastion": false,
    "enableSessionRecording": false,
    "enableShareableLink": false,
    "enableTunneling": false,
    "ipConfigurations": [
      {
        "name": "bastionHostIpConfiguration",
        "type": "Microsoft.Network/bastionHosts/bastionHostIpConfigurations",
        "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
        "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant/bastionHostIpConfigurations/bastionHostIpConfiguration",
        "properties": {
          "privateIPAllocationMethod": "Dynamic",
          "provisioningState": "Succeeded",
          "publicIPAddress": {
            "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
          },
          "subnet": {
            "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/BastionHostSubnet"
          }
        }
      }
    ],
    "provisioningState": "Succeeded",
    "scaleUnits": 2
  },
  "sku": {
    "name": "Standard"
  }
}
Status code:
201 
{
  "name": "bastionhost'",
  "type": "Microsoft.Network/bastionHosts",
  "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant'",
  "location": "West US",
  "properties": {
    "disableCopyPaste": false,
    "dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
    "enableIpConnect": false,
    "enableKerberos": false,
    "enablePrivateOnlyBastion": false,
    "enableSessionRecording": false,
    "enableShareableLink": false,
    "enableTunneling": false,
    "ipConfigurations": [
      {
        "name": "bastionHostIpConfiguration",
        "type": "Microsoft.Network/bastionHosts/bastionHostIpConfigurations",
        "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
        "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant/bastionHostIpConfigurations/bastionHostIpConfiguration",
        "properties": {
          "privateIPAllocationMethod": "Dynamic",
          "provisioningState": "Succeeded",
          "publicIPAddress": {
            "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
          },
          "subnet": {
            "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/BastionHostSubnet"
          }
        }
      }
    ],
    "provisioningState": "Succeeded",
    "scaleUnits": 2
  },
  "sku": {
    "name": "Standard"
  }
}

Create Developer Bastion Host

Sample request

PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg2/providers/Microsoft.Network/bastionHosts/bastionhostdeveloper?api-version=2026-01-01

{
  "properties": {
    "ipConfigurations": [],
    "networkAcls": {
      "ipRules": [
        {
          "addressPrefix": "1.1.1.1/16"
        }
      ]
    },
    "virtualNetwork": {
      "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg2/providers/Microsoft.Network/virtualNetworks/vnet2"
    }
  }
}

Sample response

Status code:
200 
{
  "name": "bastionhostdeveloper",
  "type": "Microsoft.Network/bastionHosts",
  "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg2/providers/Microsoft.Network/bastionHosts/bastionhostdeveloper'",
  "location": "West US",
  "properties": {
    "dnsName": "omnibrain.uswest.bastionglobal.azure.com",
    "ipConfigurations": [],
    "networkAcls": {
      "ipRules": [
        {
          "addressPrefix": "1.1.1.1/16"
        }
      ]
    },
    "provisioningState": "Succeeded",
    "virtualNetwork": {
      "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg2/providers/Microsoft.Network/virtualNetworks/vnet2"
    }
  },
  "sku": {
    "name": "Developer"
  }
}
Status code:
201 
{
  "name": "bastionhostdeveloper'",
  "type": "Microsoft.Network/bastionHosts",
  "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg2/providers/Microsoft.Network/bastionHosts/bastionhostdeveloper'",
  "location": "West US",
  "properties": {
    "dnsName": "omnibrain.uswest.bastionglobal.azure.com",
    "ipConfigurations": [],
    "networkAcls": {
      "ipRules": [
        {
          "addressPrefix": "1.1.1.1/16"
        }
      ]
    },
    "provisioningState": "Succeeded",
    "virtualNetwork": {
      "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg2/providers/Microsoft.Network/virtualNetworks/vnet2"
    }
  },
  "sku": {
    "name": "Developer"
  }
}

Create or Update Bastion Host With System Assigned Identity for Session Recording Configuration

Sample request

PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant?api-version=2026-01-01

{
  "properties": {
    "enableSessionRecording": true,
    "sessionRecordingConfiguration": {
      "identity": {
        "type": "SystemAssigned"
      },
      "blobContainerUri": "https://mystorageaccount.blob.core.windows.net/mycontainer"
    },
    "ipConfigurations": [
      {
        "name": "bastionHostIpConfiguration",
        "properties": {
          "subnet": {
            "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/BastionHostSubnet"
          },
          "publicIPAddress": {
            "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
          }
        }
      }
    ]
  }
}

Sample response

Status code:
200 
{
  "name": "bastionhosttenant",
  "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant",
  "type": "Microsoft.Network/bastionHosts",
  "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
  "location": "West US",
  "sku": {
    "name": "Premium"
  },
  "properties": {
    "provisioningState": "Succeeded",
    "dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
    "scaleUnits": 2,
    "disableCopyPaste": false,
    "enableTunneling": false,
    "enableIpConnect": false,
    "enableShareableLink": false,
    "enableKerberos": false,
    "enableSessionRecording": true,
    "enablePrivateOnlyBastion": false,
    "sessionRecordingConfiguration": {
      "identity": {
        "type": "SystemAssigned"
      },
      "blobContainerUri": "https://mystorageaccount.blob.core.windows.net/mycontainer"
    },
    "ipConfigurations": [
      {
        "name": "bastionHostIpConfiguration",
        "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant/bastionHostIpConfigurations/bastionHostIpConfiguration",
        "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
        "type": "Microsoft.Network/bastionHosts/bastionHostIpConfigurations",
        "properties": {
          "provisioningState": "Succeeded",
          "privateIPAllocationMethod": "Dynamic",
          "subnet": {
            "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/BastionHostSubnet"
          },
          "publicIPAddress": {
            "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
          }
        }
      }
    ]
  },
  "identity": {
    "type": "SystemAssigned",
    "principalId": "00000000-0000-0000-0000-000000000000",
    "tenantId": "00000000-0000-0000-0000-000000000000"
  }
}
Status code:
201 
{
  "name": "bastionhosttenant",
  "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant",
  "type": "Microsoft.Network/bastionHosts",
  "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
  "location": "West US",
  "sku": {
    "name": "Premium"
  },
  "properties": {
    "provisioningState": "Succeeded",
    "dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
    "scaleUnits": 2,
    "disableCopyPaste": false,
    "enableTunneling": false,
    "enableIpConnect": false,
    "enableShareableLink": false,
    "enableKerberos": false,
    "enableSessionRecording": true,
    "enablePrivateOnlyBastion": false,
    "sessionRecordingConfiguration": {
      "identity": {
        "type": "SystemAssigned"
      },
      "blobContainerUri": "https://mystorageaccount.blob.core.windows.net/mycontainer"
    },
    "ipConfigurations": [
      {
        "name": "bastionHostIpConfiguration",
        "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant/bastionHostIpConfigurations/bastionHostIpConfiguration",
        "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
        "type": "Microsoft.Network/bastionHosts/bastionHostIpConfigurations",
        "properties": {
          "provisioningState": "Succeeded",
          "privateIPAllocationMethod": "Dynamic",
          "subnet": {
            "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/BastionHostSubnet"
          },
          "publicIPAddress": {
            "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
          }
        }
      }
    ]
  },
  "identity": {
    "type": "SystemAssigned",
    "principalId": "00000000-0000-0000-0000-000000000000",
    "tenantId": "00000000-0000-0000-0000-000000000000"
  }
}

Create or Update Bastion Host With User Assigned Identity for Session Recording Configuration

Sample request

PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant?api-version=2026-01-01

{
  "properties": {
    "enableSessionRecording": true,
    "sessionRecordingConfiguration": {
      "identity": {
        "type": "UserAssigned",
        "userAssignedIdentityId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/userassignedmsi"
      },
      "blobContainerUri": "https://contosostorage.blob.core.windows.net/contosocontainer"
    },
    "ipConfigurations": [
      {
        "name": "bastionHostIpConfiguration",
        "properties": {
          "subnet": {
            "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/BastionHostSubnet"
          },
          "publicIPAddress": {
            "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
          }
        }
      }
    ]
  }
}

Sample response

Status code:
200 
{
  "name": "bastionhosttenant",
  "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant",
  "type": "Microsoft.Network/bastionHosts",
  "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
  "location": "West US",
  "sku": {
    "name": "Premium"
  },
  "properties": {
    "provisioningState": "Succeeded",
    "dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
    "scaleUnits": 2,
    "disableCopyPaste": false,
    "enableTunneling": false,
    "enableIpConnect": false,
    "enableShareableLink": false,
    "enableKerberos": false,
    "enableSessionRecording": true,
    "enablePrivateOnlyBastion": false,
    "sessionRecordingConfiguration": {
      "identity": {
        "type": "UserAssigned",
        "userAssignedIdentityId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/userassignedmsi"
      },
      "blobContainerUri": "https://contosostorage.blob.core.windows.net/contosocontainer"
    },
    "ipConfigurations": [
      {
        "name": "bastionHostIpConfiguration",
        "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant/bastionHostIpConfigurations/bastionHostIpConfiguration",
        "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
        "type": "Microsoft.Network/bastionHosts/bastionHostIpConfigurations",
        "properties": {
          "provisioningState": "Succeeded",
          "privateIPAllocationMethod": "Dynamic",
          "subnet": {
            "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/BastionHostSubnet"
          },
          "publicIPAddress": {
            "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
          }
        }
      }
    ]
  },
  "identity": {
    "type": "UserAssigned",
    "userAssignedIdentities": {
      "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/userassignedmsi": {
        "principalId": "00000000-0000-0000-0000-000000000000",
        "clientId": "00000000-0000-0000-0000-000000000000"
      }
    }
  }
}
Status code:
201 
{
  "name": "bastionhosttenant",
  "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant",
  "type": "Microsoft.Network/bastionHosts",
  "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
  "location": "West US",
  "sku": {
    "name": "Premium"
  },
  "properties": {
    "provisioningState": "Succeeded",
    "dnsName": "bst-9d89d361-100e-4c01-b92d-466548c476dc.bastion.azure.com",
    "scaleUnits": 2,
    "disableCopyPaste": false,
    "enableTunneling": false,
    "enableIpConnect": false,
    "enableShareableLink": false,
    "enableKerberos": false,
    "enableSessionRecording": true,
    "enablePrivateOnlyBastion": false,
    "sessionRecordingConfiguration": {
      "identity": {
        "type": "UserAssigned",
        "userAssignedIdentityId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/userassignedmsi"
      },
      "blobContainerUri": "https://contosostorage.blob.core.windows.net/contosocontainer"
    },
    "ipConfigurations": [
      {
        "name": "bastionHostIpConfiguration",
        "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/bastionHosts/bastionhosttenant/bastionHostIpConfigurations/bastionHostIpConfiguration",
        "etag": "w/\\00000000-0000-0000-0000-000000000000\\",
        "type": "Microsoft.Network/bastionHosts/bastionHostIpConfigurations",
        "properties": {
          "provisioningState": "Succeeded",
          "privateIPAllocationMethod": "Dynamic",
          "subnet": {
            "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/BastionHostSubnet"
          },
          "publicIPAddress": {
            "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/publicIPAddresses/pipName"
          }
        }
      }
    ]
  },
  "identity": {
    "type": "UserAssigned",
    "userAssignedIdentities": {
      "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/userassignedmsi": {
        "principalId": "00000000-0000-0000-0000-000000000000",
        "clientId": "00000000-0000-0000-0000-000000000000"
      }
    }
  }
}

Definitions

Name Description
BastionHost

Bastion Host resource.
BastionHostIPConfiguration

IP configuration of an Bastion Host.
BastionHostPropertiesFormatNetworkAcls
BastionHostSkuName

The name of the sku of this Bastion Host.
BastionSessionRecordingConfiguration

Bastion Session Recording Configuration.
CloudError

An error response from the service.
CloudErrorBody

An error response from the service.
IPAllocationMethod

IP address allocation method.
IPRule
ManagedServiceIdentity

Identity for the resource.
ManagedServiceIdentityUserAssignedIdentities
ProvisioningState

Provisioning states of a resource.
ResourceIdentityType

The type of identity used for the resource. The type 'SystemAssigned, UserAssigned' includes both an implicitly created identity and a set of user assigned identities. The type 'None' will remove any identities from the virtual machine.
SessionRecordingIdentity

The identity to use for accessing the blob container where recordings will be stored
SessionRecordingIdentityType

The type of identity to use
Sku

The sku of this Bastion Host.
SubResource

Reference to another subresource.

BastionHost

Object

Bastion Host resource.

Name Type Default value Description
etag

string

A unique read-only string that changes whenever the resource is updated.
id

string

Resource ID.
identity

ManagedServiceIdentity

The identity assigned to the Bastion Host resource
location

string

Resource location.
name

string

Resource name.
properties.disableCopyPaste

boolean

False

Enable/Disable Copy/Paste feature of the Bastion Host resource.
properties.dnsName

string

FQDN for the endpoint on which bastion host is accessible.
properties.enableFileCopy

boolean

False

Enable/Disable File Copy feature of the Bastion Host resource.
properties.enableIpConnect

boolean

False

Enable/Disable IP Connect feature of the Bastion Host resource.
properties.enableKerberos

boolean

False

Enable/Disable Kerberos feature of the Bastion Host resource.
properties.enablePrivateOnlyBastion

boolean

False

Enable/Disable Private Only feature of the Bastion Host resource.
properties.enableSessionRecording

boolean

False

Enable/Disable Session Recording feature of the Bastion Host resource.
properties.enableShareableLink

boolean

False

Enable/Disable Shareable Link of the Bastion Host resource.
properties.enableTunneling

boolean

False

Enable/Disable Tunneling feature of the Bastion Host resource.
properties.ipConfigurations

BastionHostIPConfiguration[]

IP configuration of the Bastion Host resource.
properties.networkAcls

BastionHostPropertiesFormatNetworkAcls

properties.provisioningState

ProvisioningState

The provisioning state of the bastion host resource.
properties.scaleUnits

integer (int32)

minimum: 2
maximum: 50

The scale units for the Bastion Host resource.
properties.sessionRecordingConfiguration

BastionSessionRecordingConfiguration

The storage account and identity to use for session recording
properties.virtualNetwork

SubResource

Reference to an existing virtual network required for Developer Bastion Host only.
sku

Sku

The sku of this Bastion Host.
tags

object

Resource tags.
type

string

Resource type.
zones

string[]

A list of availability zones denoting where the resource needs to come from.

BastionHostIPConfiguration

Object

IP configuration of an Bastion Host.

Name Type Description
etag

string

A unique read-only string that changes whenever the resource is updated.
id

string

Resource ID.
name

string

Name of the resource that is unique within a resource group. This name can be used to access the resource.
properties.privateIPAllocationMethod

IPAllocationMethod

Private IP allocation method.
properties.provisioningState

ProvisioningState

The provisioning state of the bastion host IP configuration resource.
properties.publicIPAddress

SubResource

Reference of the PublicIP resource. Null for private only bastion
properties.subnet

SubResource

Reference of the subnet resource.
type

string

Ip configuration type.

BastionHostPropertiesFormatNetworkAcls

Object
Name Type Description
ipRules

IPRule[]

Sets the IP ACL rules for Developer Bastion Host.

BastionHostSkuName

Enumeration

The name of the sku of this Bastion Host.

Value Description
Basic

Basic
Standard

Standard
Developer

Developer
Premium

Premium

BastionSessionRecordingConfiguration

Object

Bastion Session Recording Configuration.

Name Type Description
blobContainerUri

string (uri)

The blob container to store the recordings. Ex: https://contosostorage.blob.core.windows.net/contosorecordings.
identity

SessionRecordingIdentity

The identity to use for accessing the blob container where recordings will be stored

CloudError

Object

An error response from the service.

Name Type Description
error

CloudErrorBody

Cloud error body.

CloudErrorBody

Object

An error response from the service.

Name Type Description
code

string

An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
details

CloudErrorBody[]

A list of additional details about the error.
message

string

A message describing the error, intended to be suitable for display in a user interface.
target

string

The target of the particular error. For example, the name of the property in error.

IPAllocationMethod

Enumeration

IP address allocation method.

Value Description
Static

Static
Dynamic

Dynamic

IPRule

Object
Name Type Description
addressPrefix

string

Specifies the IP or IP range in CIDR format. Only IPV4 address is allowed.

ManagedServiceIdentity

Object

Identity for the resource.

Name Type Description
principalId

string

The principal id of the system assigned identity. This property will only be provided for a system assigned identity.
tenantId

string

The tenant id of the system assigned identity. This property will only be provided for a system assigned identity.
type

ResourceIdentityType

The type of identity used for the resource. The type 'SystemAssigned, UserAssigned' includes both an implicitly created identity and a set of user assigned identities. The type 'None' will remove any identities from the virtual machine.
userAssignedIdentities

<string,  ManagedServiceIdentityUserAssignedIdentities>

The list of user identities associated with resource. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'.

ManagedServiceIdentityUserAssignedIdentities

Object
Name Type Description
clientId

string

The client id of user assigned identity.
principalId

string

The principal id of user assigned identity.

ProvisioningState

Enumeration

Provisioning states of a resource.

Value Description
Failed

Failed
Succeeded

Succeeded
Canceled

Canceled
Creating

Creating
Updating

Updating
Deleting

Deleting

ResourceIdentityType

Enumeration

The type of identity used for the resource. The type 'SystemAssigned, UserAssigned' includes both an implicitly created identity and a set of user assigned identities. The type 'None' will remove any identities from the virtual machine.

Value Description
SystemAssigned

SystemAssigned
UserAssigned

UserAssigned
SystemAssigned, UserAssigned

SystemAssigned, UserAssigned
None

None

SessionRecordingIdentity

Object

The identity to use for accessing the blob container where recordings will be stored

Name Type Description
type

SessionRecordingIdentityType

The type of identity to use
userAssignedIdentityId

string (arm-id)

User assigned identity to use for accessing blob container Uri. Ex: /subscriptions/fa5fc227-a624-475e-b696-cdd604c735bc/resourceGroups/<resource group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myId. Mutually exclusive with identity type systemAssigned.

SessionRecordingIdentityType

Enumeration

The type of identity to use

Value Description
SystemAssigned

System assigned identity
UserAssigned

User assigned identity

Sku

Object

The sku of this Bastion Host.

Name Type Default value Description
name

BastionHostSkuName

Standard

The name of the sku of this Bastion Host.

SubResource

Object

Reference to another subresource.

Name Type Description
id

string

Resource ID.