Bastion provides secure remote access.
It uses RDP/SSH session is over TLS on port 443.
Note: Azure Bastion is a service you deploy that lets you connect to a virtual machine using your browser and the Azure portal. The Azure Bastion service is a fully platform-managed PaaS service that you provision inside your virtual network. It provides secure and seamless RDP/SSH connectivity to your virtual machines directly from the Azure portal over TLS. When you connect via Azure Bastion, your virtual machines don't need a public IP address, agent, or special client software.
Lock down inbound traffic to your Azure Virtual Machines with Microsoft Defender for Cloud's just-in-time (JIT) virtual machine (VM) access feature. This reduces exposure to attacks while providing easy access when you need to connect to a VM.
Meets the requirement: Only provide permission to connect the virtual machines when required Reference:
https://docs.microsoft.com/en-
us/powershell/scripting/learn/remoting/jea/overview?view=powershell-7.2
https://docs.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage
https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles