You deployed multiple AVD session hosts that have only private IP addresses. Administrators need to initiate RDP sessions to those hosts from the Azure portal. What should you implement?

Azure Bastion is the correct solution. It provides secure and seamless RDP/SSH connectivity to your virtual machines directly from the Azure portal over SSL, without exposing public IP addresses. This is crucial for session hosts with only private IPs. Remote Desktop Connection Broker and Remote Desktop Session Host are core components of a traditional Remote Desktop Services deployment but don't provide the secure, browser-based access needed for private IP VMs from the Azure portal. Azure Application Gateway is a web traffic load balancer that manages HTTP/HTTPS traffic, not RDP, and isn't designed for direct RDP access to VMs.