Azure Bastion Developer — NSG source restrictions, RDP connectivity and session termination

Hello Microsoft Azure Team,

We are evaluating Azure Bastion Developer for temporary administrative access to a disposable Windows Server 2022 Datacenter Gen2 virtual machine in Australia East, under an Azure Free Trial subscription.

Our intended configuration is:

Private VM IP address only; no public VM IP.

Dedicated virtual network, subnet and network security group (NSG).

Browser-based RDP through Bastion Developer.

Explicit deny-all inbound and outbound NSG rules, with only narrowly scoped, temporary preparation-access allowances.

No dedicated paid Bastion deployment.

The purpose is to establish temporary guest access for environment preparation and then withdraw that access before conducting separately controlled security verification.

We would appreciate clarification on the following six points.

1. Bastion Developer NSG source restrictions

What exact source IP address, CIDR range or service tag should be permitted for Bastion Developer to connect to the private VM over TCP 3389?

Can the source be restricted specifically to Bastion Developer, or does the service require a broader VirtualNetwork allowance?

2. Connectivity prerequisites

What inbound and outbound NSG rules are required specifically for Bastion Developer?

Are there Azure platform communications or guest-agent dependencies that must remain accessible?

We want to avoid applying network rules intended for dedicated paid Bastion deployments to the Developer shared-service tier.

3. Session termination and access withdrawal

Does Bastion Developer support administrator-initiated termination of active RDP sessions?

What supported procedure would allow us to terminate existing sessions and prevent reconnection after removing temporary preparation access?

4. Clipboard and file-transfer restrictions

Can clipboard copying and pasting be disabled for Bastion Developer using supported Azure, browser or Windows guest controls?

Does the Developer tier support any other file-transfer or redirection capabilities?

5. Free Trial subscription eligibility

Is Bastion Developer supported under Azure Free Trial subscriptions in Australia East, without upgrading the subscription or activating a paid Bastion tier?

6. Pricing and incidental charges

Is Bastion Developer itself free of hourly usage charges?

Are there additional connection, data-transfer or other charges beyond the underlying VM, storage and networking resources?

We would particularly appreciate references to official Microsoft documentation or an example of a supported least-privilege configuration.

Thank you for your assistance.