diff --git a/config.sample.yaml b/config.sample.yaml
index 2008e3287..7cf0da9f3 100644
--- a/config.sample.yaml
+++ b/config.sample.yaml
@@ -50,7 +50,7 @@ tre:
   firewall_sku: Standard
   app_gateway_sku: Standard_v2
   # See https://learn.microsoft.com/en-us/azure/bastion/bastion-overview#sku 
-  # Set to Standard if wish to connect to VMs in workspaces.
+  # Set to Basic if wish to connect to VMs in workspaces.
   bastion_sku: Developer
 
   # Uncomment to deploy to a custom domain
diff --git a/docs/tre-admins/environment-variables.md b/docs/tre-admins/environment-variables.md
index 0c970ec08..1a9f46b26 100644
--- a/docs/tre-admins/environment-variables.md
+++ b/docs/tre-admins/environment-variables.md
@@ -43,7 +43,7 @@
 | `RESOURCE_PROCESSOR_NUMBER_PROCESSES_PER_INSTANCE` | Optional. The number of processes to instantiate when the Resource Processor starts. Equates to the number of parallel deployment operations possible in your TRE. Defaults to `5`. |
 | `FIREWALL_SKU` | Optional. The SKU of the Azure Firewall instance. Default value is `Standard`. Allowed values [`Basic`, `Standard`, `Premium`]. See [Azure Firewall SKU feature comparison](https://learn.microsoft.com/en-us/azure/firewall/choose-firewall-sku). |
 | `APP_GATEWAY_SKU` | Optional. The SKU of the Application Gateway. Default value is `Standard_v2`. Allowed values [`Standard_v2`, `WAF_v2`] |
-| `BASTION_SKU` | Optional. The SKU of the Azure Bastion instance. Default value is `Developer`. Allowed values [`Developer`, `Standard`]. See [Azure Bastion SKU feature comparison](https://learn.microsoft.com/en-us/azure/bastion/bastion-overview#sku). |
+| `BASTION_SKU` | Optional. The SKU of the Azure Bastion instance. Default value is `Developer`. Allowed values [`Developer`, `Standard`, `Basic`, `Premium`]. See [Azure Bastion SKU feature comparison](https://learn.microsoft.com/en-us/azure/bastion/bastion-overview#sku). |
 | `CUSTOM_DOMAIN` | Optional. Custom domain name to access the Azure TRE portal. See [Custom domain name](custom-domain.md). |
 | `ENABLE_CMK_ENCRYPTION` | If set to `true`, customer-managed key encryption will be enabled for all supported resources. |
 ## For authentication in `/config.yaml`