Azure Bastion session recording vs shellz

Bastion bills by the hour from the moment it's deployed, whether or not anyone connects. These are list rates for East US, West US 2, West Europe and UK South on 3 November 2026, with a month counted as 730 hours.

• ›Developer: free, with no recording and no connections to peered networks.
• ›Basic: $0.19 an hour ($138.70 a month). No recording.
• ›Standard: $0.29 an hour ($211.70 a month), plus $102.20 a month per extra instance. No recording.
• ›Premium: $0.45 an hour ($328.50 a month) with two instances included, plus $160.60 a month per extra instance. The only tier that records.
• ›Each separate network needs its own Premium host. Three unconnected networks cost $985.50 a month, or $11,826 a year. Networks peered directly to one central network can share a host, plus peering charges.
• ›Video is stored in your own storage account and billed there.

Microsoft's recording docs list these requirements.

• ›You need a storage account and container for the videos, plus a cross-origin (CORS) rule and credentials that let Bastion write to it.
• ›The container can't have an immutability policy or blob versioning, so you can't lock recordings against deletion.
• ›Anyone who watches a recording needs read access to that storage.
• ›Recording applies to every session through the host. You can't choose which ones.
• ›Upgrading to Premium takes about 10 minutes. You can't downgrade, so going back means deleting and recreating the host.
• ›Entra ID sign-in for portal RDP doesn't work with recording turned on.

Bastion can only record what goes through a recording-enabled host in the Azure portal. That leaves several gaps.

• ›Local SSH clients. Microsoft says recording isn't available for native-client sessions, including az network bastion ssh.
• ›Other routes in. SSH over a VPN, ExpressRoute or a public IP never touches Bastion.
• ›Machines outside Azure. Bastion can connect to on-prem machines by IP address, but recording only covers VMs in the Bastion network or one peered directly to it.
• ›Searching. Recordings are video, with no transcript or command search.

shellz runs on the VM and records after SSH has decrypted the session. That covers SSH from any client, su -, console logins, SFTP transfers, one-off remote commands, and container shells opened with docker exec. tmux and screen inside a session stay in its recording. If someone logs in a way that skips the recorder, the session is killed and flagged.

An AI agent that uses SSH is recorded like a person. Password prompts are never recorded. Recordings are signed and stored write-once, and every viewing is logged (security design).

Commercial is $10 a member a month plus $1 per GB stored, with no limit on devices or retention. Five people cost $50 a month before storage, whether you have one network or ten. The free plan covers 10 active devices and keeps the newest 50 recordings. Personal Pro is $1 a month, billed annually, for 20 devices and 90 days of recordings (pricing).

shellz only records Linux terminals. It doesn't give you a private path to the VM, manage credentials, approve temporary access or issue SSH certificates. It doesn't record RDP, Windows, macOS, Kubernetes or database sessions. It can't block commands or end a live session, and it has no SIEM export, public API or self-hosted version. shellz hasn't published a SOC 2 report.

Choose Bastion if you need Windows RDP recorded, can't install anything on the VMs, want a Bastion host with no public IP (Premium), or already manage access with Entra ID and Azure roles. The PAM vs session recording guide explains why getting in and keeping a record are separate decisions.

You can run both. Bastion provides the way in, and shellz on Linux VMs records the local-client and VPN sessions Bastion never sees. If you bought Premium only for recording, moving to Standard (which means recreating the host) saves $116.80 per host a month. For other clouds, see shellz vs AWS Session Manager and shellz vs Teleport.