You deploy multiple Windows Virtual Desktop session hosts that have only private IP addresses. You need to ensure that administrators can initiate an…

Azure Bastion is a fully managed platform-as-a-service (PaaS) that provides secure and seamless Remote Desktop Protocol (RDP) and Secure Shell (SSH) connectivity to virtual machines directly through the Azure portal. It is deployed within a virtual network and allows administrators to connect to session hosts that have only private IP addresses, without exposing them to the public internet. This eliminates the need for public IPs on the session hosts or complex network security group (NSG) rules for RDP access, directly fulfilling the requirement to initiate a session from the Azure portal.

A. Remote Desktop Connection Broker (RD Connection Broker): In Azure Virtual Desktop, the connection broker is a managed service provided by Microsoft as part of the AVD control plane, not a component you implement for this purpose.

B. Azure Application Gateway: This is a layer 7 web traffic load balancer and Web Application Firewall (WAF), designed for managing and securing web applications, not for providing direct RDP access from the Azure portal.

D. Remote Desktop Session Host (RD Session Host): This is the role of the virtual machines themselves. The session hosts are already deployed; this option describes what they are, not the mechanism implemented to connect to them via the portal.

1. Microsoft Documentation - What is Azure Bastion?: "Azure Bastion is a service you deploy that lets you connect to a virtual machine using your browser and the Azure portal... When you connect via Azure Bastion

your virtual machines don't need a public IP address

agent

or special client software." This directly supports the use of Bastion for connecting to private VMs from the portal.

Source: Microsoft Learn

What is Azure Bastion?

"About Azure Bastion" section.

2. Microsoft Documentation - Azure Virtual Desktop architecture: This document explains the AVD architecture

where components like the RD Broker are part of the Microsoft-managed control plane. "The Azure Virtual Desktop service is a managed service that provides a control plane for your desktop virtualization environment... The components are: ... Connection Broker: Manages user connections to session hosts."

Source: Microsoft Learn

Azure Virtual Desktop architecture

"Control plane" section.

3. Microsoft Documentation - Connect to a virtual machine using Azure Bastion: This tutorial provides the steps for connecting to a VM. "This article shows you how to securely and seamlessly connect to a VM in an Azure virtual network directly from the Azure portal."

Source: Microsoft Learn

Tutorial: Connect to a virtual machine using Azure Bastion

"Introduction" section.