Accessing Azure resources from an offsite location

MrFlinstone 481 Reputation points
2022-06-11T19:39:53.303+00:00

I have an azure application that runs on PaaS architecture. To access azure resources like sql or add, I would like that to go through a secure virtual machine instead of from personal devices which is what happens today.

The problem today is that access is from personal devices which can be a personal Pc or laptop, secondly if the personal laptop is compromised this presents a risk. Third point, IP addresses change from ISP's when coming from a personal device this means that multiple up address entries are required for the sql firewall, if access is from a VM, the hassle of managing public IP address entries can be eliminated.

What is the best way to configure this (jump host, bastion host, VPN) and is it possible to have more than one virtual machine for access from a disaster recovery perspective. I am after a few options with some comments on the cost implication please., and if it can be on demand.

Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,379 questions
Azure Bastion
Azure Bastion
An Azure service that provides private and fully managed Remote Desktop Protocol (RDP) and Secure Shell (SSH) access to virtual machines.
241 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. msrini-MSFT 9,256 Reputation points Microsoft Employee
    2022-06-13T04:00:44.98+00:00

    Hi MrFlinstone-1451,

    You can configure P2S in the VNET by deploying a VPN gateway and use certificate based auth and share the exe file and cert to the users who want to access the SQL remotely.

    This way users from remote can securely connect to the Azure VNET. You will need to setup Private Endpoint in the same VNET and link to the SQL resource.

    When that happens, all traffic to the SQL will be private connection and you can block the public access to the SQL completely.

    Reference: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal
    Private Endpoint: https://learn.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-sql-portal

    Regards,
    Karthik Srinivas