What firewall port must be open to allow RDP connections through Azure Bastion?

To allow Remote Desktop Protocol (RDP) connections through Azure Bastion, the required firewall port is TCP 443. Azure Bastion uses this port to establish a secure connection between the Bastion service and the user's web browser.

By utilizing TCP 443, which is the standard port for HTTPS traffic, Azure Bastion can efficiently secure RDP and SSH connections without requiring a direct exposure of the underlying virtual machines' RDP ports (TCP 3389). This greatly enhances security, as it minimizes the attack surface by eliminating the need to open RDP ports directly on the VMs.

This setup also ensures that users can access their virtual machines without needing to manage any public IP addresses or additional firewall rules, simplifying the configuration and management of remote desktop services.