How to fix login issue to Azure VM

A restart or reboot can help in some cases, but it is not a reliable fix by itself.

For Azure Bastion login failures, the most common causes are usually on the target VM:

• The VM is stopped or deallocated
• RDP or SSH service is not running
• Guest OS firewall is blocking port 3389 or 22
• An NSG rule is blocking Azure Bastion to VM connectivity
• The VM agent is unhealthy
• On Windows, Network Level Authentication (NLA) is misconfigured

If the VM is already running, use this path:

1. Confirm the Bastion resource provisioning state is Succeeded.
2. Check whether the failure is specific to one VM. If Bastion works for other VMs in the same VNet, the issue is likely on this VM.
3. Verify the VM agent health. If the VM agent is unhealthy or not ready, fix that first.
4. Check NSG rules to ensure inbound TCP 3389 for Windows or 22 for Linux is not denied from the Azure Bastion subnet.
5. For Windows, verify Remote Desktop Services is running and RDP is enabled.
6. For Linux, verify the SSH daemon is running and listening on port 22.
7. Check the guest OS firewall:
   • Windows Firewall must allow RDP
   • iptables or firewalld must not block SSH
8. If a Windows Bastion session connects and then drops immediately after authentication, check for an NLA issue.

About restart/reboot specifically:

• A reboot can sometimes clear temporary guest OS issues.
• Azure VMs can also restart because of guest OS crashes, storage-related forced shutdowns, or Azure platform maintenance.
• To investigate unexpected restarts, check system and application logs for Windows VMs, serial logs for Linux VMs, and use the Diagnose and Solve blade on the VM.
• If there is a guest OS issue, collecting a memory dump is the recommended way to identify the root cause.

If all Bastion diagnostics pass and sessions still fail, file an Azure support request.

References:

• Troubleshoot Azure Bastion session failures due to unhealthy target VMs
• Understand a system reboot for Azure VM