Skip to content
Back to Docs
Host Pool Management
5 min

Cut Azure Bastion Costs with a Bastion Schedule

Azure bills a Bastion host for every hour it exists, whether or not anyone connects through it, and Azure has no way to stop or pause one. A Bastion schedule in Atlas AVD gives you the next best thing: at the Auto Off time Atlas removes the host, and at the Auto On time it puts the host back with the same settings. The AzureBastionSubnet and the public IP address are never touched, so the address your team connects to does not change.

Prerequisites

  • An Atlas AVD plan. Bastion schedules are part of Auto On/Off Scheduling, which is not included in Community.
  • The administrator role
  • A Bastion host on the Basic, Standard or Premium SKU. The Developer SKU is free, so there is nothing to schedule.
  • The Network Contributor role for the Atlas app registration on the subscription that holds the Bastion host. A standard Atlas setup already grants it.

Set a schedule

  1. 1Open Resources and choose the VNets tab. Virtual networks that contain an AzureBastionSubnet show a Bastion badge.
  2. 2Click Schedule next to the Bastion badge. The dialog lists each Bastion host in that virtual network.
  3. 3Set the Auto On and Auto Off times, the days, and the time zone. A new schedule starts at 6:00 AM to 10:00 PM Eastern Time, Monday to Friday.
  4. 4Leave Schedule Enabled on and click Save.

Saving a schedule never removes the host straight away. If you save at 11:00 PM with a 10:00 PM Auto Off, the first removal is the next scheduled Auto Off.

What happens at Auto Off

  • Atlas first asks Azure whether anyone has a session open through the host. If so, it waits and checks again every minute, for up to 2 hours, then removes the host.
  • Atlas saves the host's configuration: SKU, scale units, feature settings such as native client support, tags, availability zones and diagnostic settings.
  • Atlas deletes the Bastion host. The AzureBastionSubnet, the public IP address and your virtual network are left exactly as they are.
  • The host shows as Off on its schedule in the dialog and in the Connect menu.

What happens at Auto On

Atlas recreates the host from the saved configuration. Azure takes about 10 minutes to deploy a Bastion host, so set Auto On a little before the first person needs to connect. When Azure reports the host ready, Atlas re-applies its diagnostic settings and the host shows as Running again.

  • On a day listed in your tenant's holidays, Auto On is skipped and the host stays off. Auto Off always runs.
  • On days that are not selected, nothing happens. With a Monday to Friday schedule the host is removed on Friday night and comes back on Monday morning.
  • If Atlas was offline when a scheduled time passed, it applies the most recent scheduled change as soon as it is running again.

Connect outside working hours

You do not need to change the schedule for a one-off. Open the Connect menu on any VM in that virtual network: the Bastion options show Off on its schedule, with a Start Bastion entry underneath. Click it and the host is recreated, which takes about 10 minutes. You can also click Start Bastion in the schedule dialog. A host started this way stays up until the next scheduled Auto Off.

What a schedule does not restore

  • Shareable links: links created before the host was removed stop working. Create new ones after it is back.
  • Role assignments made directly on the Bastion host resource. Assignments made on the resource group or subscription are unaffected.
  • Resource locks: a delete lock on the host, or on its resource group, stops Auto Off. The host stays running and the dialog shows the reason Azure gave.

While a host is off, its schedule holds the only copy of the host's configuration. Atlas will not let you remove the schedule until the host is running again, and you should not delete the AzureBastionSubnet or the public IP address in the meantime.

How much it saves

The saving is the share of the week the host no longer exists. With the starting schedule the host exists for 80 of the week's 168 hours, so the Bastion host charge falls by a little over half. A shorter day, or the same hours on fewer days, saves more. The public IP address is still billed while the host is off, which is a small fraction of the host's cost.

If something goes wrong

  • The dialog shows Last problem with the message Azure returned, for example a lock that blocked the removal or a permission the app registration is missing.
  • A removal or recreate that fails for a temporary reason, such as Azure throttling, is retried on the next minute.
  • If Azure reports that a recreate failed, the host goes back to Off on its schedule. Click Start Bastion to try again.
  • To stop scheduling a host, turn Schedule Enabled off, or start the host and click Remove schedule.

Related articles

Scaling ConfigurationSchedule Maintenance Windows for Host PoolsImage ManagementAll documentation

Schedule Azure Bastion in Atlas AVD: the host is removed outside working hours and recreated before them, so you stop paying for the hours nobody connects.

Before you begin

Next steps