Your company has deployed an Azure virtual Desktop and a Domain Controller to an Azure VNet. The company has a strict policy that does not allow direct RDP access to any servers inside the VNet. Which of the following solution will allow the administration of the session hosts and domain controller from outside the VNet? (Choose the best reliable option)

Answer options:

A.Conditional Access Policy
B.Azure Bastion
C.Azure Advisor
D.Just In Time Access

Correct Answer: B 
Azure Bastion utilizes an HTML5 based web client automatically streamed to your local device. Here, you get your RDP/SSH session over TLS over port 443, which enables you to traverse company firewalls securely.
Option A is incorrect. Conditional Access Policy won’t help with the administration of the session hosts and domain controller from outside the VNet.
Option B is correct. Azure Bastion will offer remote desktop access to servers in the virtual network over port 443, without opening RDP ports to external networks.
Option C is incorrect. Azure Advisor analyzes your configurations and telemetry to provide personalized recommendations to solve the common issues and problems. It won’t resolve the given issue.
Option D is incorrect. Just In Time access also opens RDP ports, but temporarily.
Reference: 
To know more about Azure Bastion, please visit the below-given link: 

https://docs.microsoft.com/en-us/azure/bastion/bastion-overview?WT.mc_id=AZ-MVP-5004159