🛡️ Azure Bastion Host shareable links are enabled🟢

• Contextual name: 🛡️ Bastion Host shareable links are enabled🟢
• ID: /ce/ca/azure/bastion/shareable-link
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Bastion Host
  • 🔌 Azure Bastion Host - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Shareable Link lets anyone holding a Bastion-generated URL reach a virtual machine's RDP or SSH sign-in without signing in to the Azure portal. Each Standard or Premium Bastion host has Shareable Link Enabled or Disabled; Basic and Developer hosts lack the feature and are out of scope.

Rationale

A shareable link exposes a virtual machine's RDP or SSH sign-in to anyone who obtains the URL, with no Microsoft Entra ID authentication, Conditional Access, or Azure role assignment in front of it. A leaked or forwarded link leaves only the virtual machine's local credentials between an attacker and an interactive session until the link expires or is deleted.

Audit

This policy marks an Azure Bastion Host as INCOMPLIANT if the SKU is Standard or Premium and Shareable Link State is Enabled.

Disabled is COMPLIANT. Basic and Developer SKUs lack this feature and are INAPPLICABLE.

Remediation

Open File

Remediation

Disable Shareable Link on the affected Standard or Premium Azure Bastion host.

Coordinate with users who rely on shareable links before deleting links or disabling the feature. Confirm that they can connect through an approved authenticated access path, such as Azure Bastion through the Azure portal, with the required Azure permissions and virtual machine credentials.

Remove Existing Shareable Links

1. In the Azure portal, go to Bastions and select the affected host in the intended subscription.
2. Under Settings, select Shareable links.
3. Select the existing links and click Delete. Confirm the deletion and repeat until the list is empty.

Delete existing links before disabling the feature. Microsoft does not document whether disabling Shareable Link deletes stored links. Removing them first prevents those links from becoming usable again if the feature is later re-enabled.

From Azure Portal

1. On the affected Bastion host, under Settings, select Configuration.
2. Clear Shareable Link.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 8.4.2 Ensure 'Shareable Link' is Disabled on Azure Bastion Hosts (Automated)			1		no data
💼 Cloudaware Framework → 💼 Secure Access			63		no data