Azure Bastion previews managed identity for session recordings

Azure Bastion added managed-identity authentication for graphical session recording in public preview. The announcement says a Bastion deployment can use a system-assigned or user-assigned identity to write recordings to a designated Blob container through Entra ID and Azure RBAC.

Recording storage gets an Azure identity

The earlier credential-bearing path required operators to manage access material for storage. With this preview, Bastion obtains tokens for its assigned identity. Microsoft lists Bastion Premium, a dedicated recording container, required CORS configuration, and role assignments among the prerequisites. The Bastion identity needs write access; people viewing recordings need their own read permissions.

This separates service write access from viewer access and makes assignments visible in Azure control-plane inventory. It does not solve retention, privacy, or review governance for captured privileged sessions.

Treat recordings as sensitive evidence

Create a dedicated storage account or container with a documented retention rule and narrowly scoped roles. Verify which identity Bastion actually uses, then assign only the required Blob data role. Test recording, playback, token refresh, and behavior when the role is removed.

Restrict who can list or read recordings, log data-plane access, and decide how investigations preserve a recording past routine expiry. Session captures may contain commands, filenames, or secrets shown on screen, so access review and deletion policy matter as much as reliable writes.

Because managed-identity support is preview, pilot it outside the only administrative path. Monitor for missing recordings and keep an explicit recovery procedure while Microsoft evolves the feature.