What should be created first when deploying Azure Bastion to connect to Azure Virtual Desktop session hosts?

When deploying Azure Bastion to connect to Azure Virtual Desktop session hosts, it is essential to create a new subnet named AzureBastionSubnet first. This specific subnet is a prerequisite for the Azure Bastion service to function correctly.

Azure Bastion requires a dedicated subnet to ensure secure remote access to the Azure Virtual Desktop without exposing the session hosts to the Internet directly. By creating the AzureBastionSubnet, you are setting up a secure network environment where Azure Bastion can provision itself and handle traffic.

This subnet must follow certain naming conventions and sizing requirements set by Microsoft, which helps Azure identify and allocate resources efficiently for Bastion service. With AzureBastionSubnet already in place, subsequent steps in configuring Azure Bastion become streamlined, such as creating the necessary application groups and establishing NSG rules to manage traffic effectively.

Establishing this subnet first is crucial because it sets the foundation for secure connectivity and proper integration with the Azure Virtual Desktop resources.