Azure Bastion Session Recording – Blob Container URI not configurable via ARM/Bicep/CLI

Hi @ Vladimir Bannikov,

As there is currently no official Microsoft documents available for this configuration, you can use the below Bicep template to update the Blob Container URI in Azure Bastion Session Recording .

/**
  * Example Bastion Host template for session recording with managed identities
  *
  * Key points:
  *  - Api Version must be 2025-01-01 or later to support session recording with managed identities
  *  - Identity must be assigned to the bastion
  *  - sessionRecordingConfiguration.identity.type must match the identity.type of the bastion
  *  - sessionRecordingConfiguration.identity.userAssignedIdentityId must be provided if using user assigned identities
  *  - sessionRecordingConfiguration.blobContainerUri must be provided
  *  - sessionRecordingConfiguration.identity.userAssignedIdentityId must be present in the identity.userAssignedIdentities of the bastion if using user assigned identities
*/
resource bastionHost 'Microsoft.Network/bastionHosts@2025-01-01' = {
  name: 'bastionName'
  sku: {
    name: 'Premium'
  }
  location: resourceGroup().location
  properties: {
    enableIpConnect: false
    enableTunneling: false
    enableShareableLink: false
    enableKerberos: false
    disableCopyPaste: false
    enableSessionRecording: true
    ipConfigurations: [
      {
        name: 'IpConf'
        properties: {
          subnet: {
            id: azureBastionSubnetId
          }
          publicIPAddress: {
            id: bastionPublicIpAddress.id
          }
        }
      }
    ]
    scaleUnits: 2
    enablePrivateOnlyBastion: false
    sessionRecordingConfiguration: {
      identity: {
        type: 'UserAssigned' // Must match the identity type of the bastion host
        userAssignedIdentityId: '<your user assigned identity resource ID>' // Replace with your user assigned identity resource ID, omit if system assigned
      }
      blobContainerUri: 'https://<your storage account name>.blob.core.windows.net/<your container name>' // Replace values
    }
  }
  identity: {
    type: 'UserAssigned' // Must match the identity type of the bastion host
    userAssignedIdentities: {
      '<your user assigned identity resource ID>': {} // Replace with your user assigned identity resource ID
    }
  }
}
 

I would recommend using user assigned identities and making sure the identity has permissions before deploying.

REST API's

https://management.azure.com/subscriptions/<subid>/resourceGroups/<rg-name>/providers/Microsoft.Network/bastionHosts/<bastion-name>/setsessionrecordingsasurl?api-version=<api-version>


https://management.azure.com/subscriptions/<subid>/resourceGroups/<rg-name>/providers/Microsoft.Network/bastionHosts/<bastion-name>/getsessionrecordingsasurl?api-version=<api-version>

For both requests, please use the following configuration:

• HTTP Method: POST
• Authorization Header: Bearer Token

The request body should be configured as follows:

{
  sasUrl: "some-sas-url"
}

Pleaseand “up-vote” wherever the information provided helps you, this can be beneficial to other community members.