Creating a new Bastion - Failed to deploy

Question

Creating a new Bastion - Failed to deploy

Josie L 80

Created a VM, and I am trying to secure it with Bastion. I believe all looks good, but when trying to deploy, I get "Failed to create new Bastion".

Venkatesan S 6,920 Reputation points Microsoft External Staff Moderator

2026-03-25T21:51:17.7933333+00:00
Hi Josie Lewis,

Thanks for reaching out in Microsoft Q&A forum,

The "Failed to create new Bastion" error during Azure Bastion deployment for your VM is a common issue often tied to prerequisite misconfigurations or resource limits.

Double-check your VNet has a dedicated AzureBastionSubnet (at least /26 for Standard SKU). Create it manually first via portal or CLI before deploying don't rely on auto-create, as it flakes out sometimes. No NSG or UDR on that subnet either, since Bastion handles its own rules.

Deployment Fixes:

Quotas: Head to Subscriptions > Usage + quotas in the portal; bump public IP limits if maxed out, then retry in another region if needed.

Logs first: In Resource Group > Deployments, click the failed one for JSON details—look for "GatewayAllocationFailed" or similar.

Retry with CLI for better errors: az network bastion create --resource-group myRG --name myBastion --vnet-name myVNet --subnet AzureBastionSubnet --location eastus.

Reference:

Azure Bastion FAQ | Microsoft Learn

Kindly let us know if the above helps or you need further assistance on this issue.

Please “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Venkatesan S 6,920 Reputation points Microsoft External Staff Moderator

2026-03-26T23:01:24.6866667+00:00

Hi Josie Lewis,

We haven’t heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please “up-vote” if the information helped you. This will help us and others in the community as well.
Venkatesan S 6,920 Reputation points Microsoft External Staff Moderator

2026-03-30T06:50:20.0233333+00:00

Hi Josie Lewis,

We haven’t heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please “up-vote” if the information helped you. This will help us and others in the community as well.

Answer accepted by question author

0 additional answers

Your answer

Venkatesan S 6,920 Reputation points Microsoft External Staff Moderator

2026-03-25T21:51:17.7933333+00:00

Hi Josie Lewis,

Thanks for reaching out in Microsoft Q&A forum,

The "Failed to create new Bastion" error during Azure Bastion deployment for your VM is a common issue often tied to prerequisite misconfigurations or resource limits.

Double-check your VNet has a dedicated AzureBastionSubnet (at least /26 for Standard SKU). Create it manually first via portal or CLI before deploying don't rely on auto-create, as it flakes out sometimes. No NSG or UDR on that subnet either, since Bastion handles its own rules.

Deployment Fixes:

Quotas: Head to Subscriptions > Usage + quotas in the portal; bump public IP limits if maxed out, then retry in another region if needed.

Logs first: In Resource Group > Deployments, click the failed one for JSON details—look for "GatewayAllocationFailed" or similar.

Retry with CLI for better errors: az network bastion create --resource-group myRG --name myBastion --vnet-name myVNet --subnet AzureBastionSubnet --location eastus.

Reference:

Azure Bastion FAQ | Microsoft Learn

Kindly let us know if the above helps or you need further assistance on this issue.

Please “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Venkatesan S 6,920 Reputation points Microsoft External Staff Moderator

2026-03-26T23:01:24.6866667+00:00

Hi Josie Lewis,

We haven’t heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please “up-vote” if the information helped you. This will help us and others in the community as well.
Venkatesan S 6,920 Reputation points Microsoft External Staff Moderator

2026-03-30T06:50:20.0233333+00:00

Hi Josie Lewis,

We haven’t heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please “up-vote” if the information helped you. This will help us and others in the community as well.

Answer 1

Hello Josie Lewis

We went around Bastion and used a virtual network connection.

Firstly,

Dedicated subnet requirement The virtual network must contain a subnet named exactly AzureBastionSubnet. The subnet name is not configurable and must be created explicitly before deployment. Additionally, the subnet must be at least /26 in size. Smaller subnets are not supported and will cause deployment failures. Microsoft docs: Azure Bastion Deployment and configuration issues
No NSG or route table on AzureBastionSubnet The AzureBastionSubnet must not have a Network Security Group (NSG) or a user‑defined route (UDR) associated with it. Azure Bastion manages its own connectivity and attaching NSGs or routes to this subnet is not supported.
Azure Bastion requires a Standard Public IP address. If the subscription has reached the Public IP quota limit, Bastion deployment will fail. Microsoft explicitly lists subscription limits and quotas as a common cause of Bastion deployment failures.
Forced tunneling is not supported Azure Bastion does not support forced tunneling scenarios (for example, advertising 0.0.0.0/0 via VPN or ExpressRoute). Bastion requires direct connectivity to Azure control plane endpoints, and forced routing can prevent successful deployment.
Same region requirement The Bastion host must be deployed in the same virtual network and region as the target virtual machine. Region mismatches can result in deployment or visibility issues.

Try via CLI for clearer errors

   az group create --name TestRG1 --location eastus
   
   az network vnet create --resource-group TestRG1 --name VNet1 --address-prefix 10.1.0.0/16 --subnet-name default --subnet-prefix 10.1.0.0/24
   
   az network vnet subnet create --name AzureBastionSubnet --resource-group TestRG1 --vnet-name VNet1 --address-prefix 10.1.1.0/26
   
   az network public-ip create --resource-group TestRG1 --name VNet1-ip --sku Standard --location eastus
   
   az network bastion create --name VNet1-bastion --public-ip-address VNet1-ip --resource-group TestRG1 --vnet-name VNet1 --location eastus --sku Basic

How to deploy Bastion with Azure CLI

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

If these answer your question, click "Upvote" and click "Accept Answer" which may be beneficial to other community members reading this thread.

Share via

Creating a new Bastion - Failed to deploy

0 additional answers

Your answer