What changed

Microsoft announced on 26 August 2026 that Azure Bastion shareable link expiration is generally available. The announcement states that when creating a shareable link, administrators can specify the date and time the link should expire, after which “the link can no longer be used to connect to the target resource”. The shareable link documentation places the control on the Create shareable link page: “When you create a shareable link, specify when the link expires.” The Shareable links page carries an Expiration column, and an expired link’s Resource status changes to “Link expired”. The feature requires the Standard SKU, a Bastion resource supports up to 500 shareable links, and Microsoft’s documented route for closing an existing link is the Delete action.

The operational risk is easy to miss because the service can continue to look healthy. The control becomes visible only when a capacity request fails, an unsupported runtime is removed, or an extension blocks an enforced ERP update. Waiting for that moment transfers a planned decision into an incident.

What the term means in plain language

Azure Bastion is a managed service that provides RDP and SSH connectivity to virtual machines without giving those machines public IP addresses. A shareable link is a Bastion feature that produces a URL which, when opened in a browser, presents a sign-in prompt for a specific target machine. Microsoft’s documentation states the link lets a user connect “without accessing the Azure portal” and that “a user without Azure credentials” can use it. The link itself carries no password: Microsoft states “The shareable link doesn’t contain any credentials – the admin must provide sign-in credentials to the user.”

This distinction matters because product status is not the same as business readiness. Availability, support and compatibility are separate questions. A service can be available but unsupported, supported but capacity-constrained, or technically updated while a customer-specific process has stopped working.

Why this matters to a South African organisation

South African teams often operate with tight specialist capacity, rand-sensitive budgets and business processes that cannot be paused while a replacement is sourced. Localisation, regional cloud capacity and long procurement lead times can narrow the recovery options. The practical response is to use the available test window before it becomes an emergency window.

The consequence belongs to the business process, not only the technology team. Finance month-end, customer transactions, data pipelines and ERP extensions all cross technical and operational ownership. A change should therefore be accepted only when the service owner and the business owner can see the same evidence.

The hidden exposure

Azure Bastion shareable links let someone with no Azure account open a remote desktop or SSH session on one of your servers from a browser. On 26 August 2026 Microsoft made link expiry generally available, and the documentation places the expiry on the Create shareable link page. The documented way to close a link that already exists is to delete it. A Bastion host can hold 500 of them.

Normal operation is weak evidence. It proves only that yesterday’s combination of platform, configuration and workload completed. It does not prove that the next capacity allocation, lifecycle enforcement or major release will preserve the same result. An owner needs an inventory, a representative test and a dated decision.

Decision path

The capability is not the story. The population is. An expiry field that is filled in at creation time only becomes useful for links made from now on, which means the value of this announcement is almost entirely in the audit it should prompt rather than in the setting itself. That audit is worth doing for a reason the documentation makes plain without ever framing it as a risk: a shareable link is a door into a server that works for someone who has no account with you, no directory entry, and nothing to revoke. When a contractor’s engagement ends, an Entra account gets disabled and a laptop gets returned. A URL in an email thread does neither. Microsoft’s own note about deleted target resources is the detail worth sitting with, because it establishes that these links outlive things: “If a link is no longer able to be opened, this means that someone in your organization has deleted that resource. While you’ll still be able to see the shared links in your list, it will no longer connect to the target resource.” Braintree’s reading, and it is a reading rather than Microsoft’s wording: every shareable link an organisation issued before 26 August 2026 was created at a time when the expiry field did not exist, so nobody set one. The review is small. Five hundred is the ceiling, most estates hold a handful, and the page now shows the expiry alongside each entry, so this is closer to ten minutes than to a project.

Record the alternatives that were rejected and why. That prevents the next reviewer from reopening the entire question without context. Where the preferred path cannot be completed inside seven days, approve a time-bound exception with a responsible owner, expiry date and compensating control.

Technical test plan

Start in the Azure portal at the Bastion resource, then Shareable links. The list shows each link, its target resource, its status and, since the 26 August release, its expiration. Work down it and record for each row: the target machine, who the link was issued to, the business reason, and whether the engagement that justified it is still running. Anything failing that last test gets deleted from the same page. Two operational limits matter while you work. Microsoft states “Bastion only supports 50 requests, including creates and deletes, for shareable links at a time”, so a large clean-up is done in batches rather than in one action. And the feature requires the Standard SKU, so if the Shareable Link feature is not visible under Configuration the tier is Basic and no links exist to review. Check the permissions alongside the list, because they are not what most people assume. Microsoft states that “By default, users in your org have only Read access to shared links” and that Read access means a user “will only be able to use and view shared links” while being unable to create or delete them. Read is therefore a use right, not merely a visibility right. Create and delete are governed by three specific actions on the Bastion host, Microsoft.Network/bastionHosts/createShareableLinks/action, deleteShareableLinks/action and deleteShareableLinksByToken/action, plus getShareableLinks/action, without which a user cannot see a link at all. Confirm who holds those on each Bastion host and whether that set matches the people who should be issuing external access. For links created from now on, set the expiration to the end of the engagement rather than to a round number of days, and treat a request to extend as a new link rather than a longer one. Note the constraints Microsoft lists for the feature generally: shareable links are not supported across peered virtual networks in different tenants, are not supported over Virtual WAN, and do not support connections to on-premises or non-Azure machines.

Use production-representative conditions without exposing production data unnecessarily. Capture the starting configuration, exact version, time of test and expected result. A pass requires evidence from the real workflow, not only a successful login or an unchanged dashboard.

Primary owner

Primary owner: Whoever owns the Bastion host, usually the cloud infrastructure or network security lead, with the person accountable for third-party and supplier access.

The named owner coordinates platform, application, commercial and business-process decisions. Contributors may perform the work, but accountability cannot be distributed across a meeting invite. The owner closes the test, exception and evidence record.

Action within seven days

Action within seven days: Open the Bastion resource, go to Shareable links, and read the Expiration column against the list. For every link, name the person it was issued to and the reason it is still standing. Delete the ones that cannot be named. Export the list before you start and after you finish, because the before list is the finding and the after list is the fix.

Start with the highest-consequence workload. Assign the people, date and pass criteria before the test begins. If the first test fails, record the failure as evidence and open remediation with a deadline rather than hiding it behind a general project status.

Evidence to retain

Evidence to retain: The dated export of the shareable links list per Bastion host, taken before and after the review, showing the resource, the expiration value and the disposition of each link. Add the IAM assignment showing who currently holds create and delete rights on the Bastion host.

Store the evidence with the platform or change record. Include source exports and machine-readable results where possible. The next reviewer should be able to reproduce the conclusion without rebuilding it from email, chat or memory.

Frequently asked questions

What exactly changed on 26 August?

Azure Bastion shareable link expiration reached general availability. Microsoft states that when creating a shareable link, an administrator can specify the date and time the link expires, and that after that time the link can no longer be used to connect to the target resource.

Can I add an expiry to a link that already exists?

Microsoft’s documentation describes setting the expiry on the Create shareable link page and describes deletion as the way to remove an existing link. It does not state that an existing link can or cannot be given an expiry retrospectively. Rather than infer a prohibition from silence, treat deletion as the documented route and re-issue with an expiry where the access is still needed.

Does the person receiving the link need an Azure account?

No. Microsoft states that a user without Azure credentials clicks the link and is prompted to sign in to the target resource by RDP or SSH, using a username and password or a private key depending on how the target is configured.

So the link is a credential?

Not on its own. Microsoft is explicit that the link carries no credentials and that the administrator supplies sign-in details separately. It is better understood as a persistent route to the sign-in prompt of a specific machine, available to anyone holding the URL.

How many links can exist, and who can see them?

Microsoft states a Bastion resource supports up to 500 shareable links. By default users in the organisation hold Read access, which Microsoft defines as being able to use and view shared links without being able to create or delete them.

Which SKU do I need?

The Standard SKU. Microsoft states the tier can be moved from Basic to Standard when the shareable links feature is configured.

Is there a South African angle?

Only in how the feature tends to get used. A shareable link is the common way to give an outside contractor or a supplier’s support engineer access to a server without creating an identity for them, which is a frequent arrangement where the supplier is a small local integrator. That makes this review a supplier-access review as much as a cloud one.

The Braintree view

Microsoft’s announcement supplies the platform fact. The customer control begins after that fact: identify the exposed process, name the owner, test the real dependency and retain a decision that can survive audit or staff turnover. Braintree can help structure the inventory, build the representative test and translate the result into a controlled implementation plan.

Use the seven-day action as the entry point. Do not wait for a renewal, support refusal or enforced update to reveal work that can be measured now.