Azure Bastion can be used to establish RDP connections for a user in an Azure tenant to an on- premises server in an Active Directory Domain Services (AD DS) domain, and it can be configured to require multifactor authentication (MFA) for those connections. Azure Bastion provides secure and seamless RDP connectivity to VMs, including those within an AD DS domain, directly from the Azure portal over SSL, without exposing them to public IP addresses.
Reference:
https://learn.microsoft.com/en-us/entra/identity/domain-services/secure-remote-vm-access