Microsoft Learn describes how to create a secure RDP connection to your Windows virtual machines using Azure Bastion.

You can connect through the Azure portal (browser-based), via a specified IP address, or using a native client on your local Windows computer. When you use Azure Bastion, your virtual machines don't require a client, agent, or additional software. Azure Bastion securely connects to all virtual machines in the virtual network without exposing RDP/SSH ports to the public internet.

This method connects directly through your browser. No native RDP client or additional software is required on your local computer. The Basic SKU or higher is required, or the Standard SKU if you need custom ports.

For IP-based connection, this method connects through your browser and doesn't require a native RDP client or additional software on your local computer. The Standard SKU or higher is required, and you must enable IP-based connection.

Prerequisites include an Azure Bastion host deployed in the virtual network where the virtual machine is located, or in a peered virtual network; a Windows virtual machine in the virtual network; and required roles such as Reader role on the virtual machine, NIC, Azure Bastion resource, and virtual network of the target virtual machine.