diff --git a/azure/scope/cluster.go b/azure/scope/cluster.go
index d03f73e0b18..6cbe5a5e37e 100644
--- a/azure/scope/cluster.go
+++ b/azure/scope/cluster.go
@@ -539,13 +539,14 @@ func (s *ClusterScope) AzureBastion() *infrav1.AzureBastion {
 }
 
 // AzureBastionSpec returns the bastion spec.
-func (s *ClusterScope) AzureBastionSpec() azure.ResourceSpecGetter {
+func (s *ClusterScope) AzureBastionSpec() azure.ASOResourceSpecGetter[*asonetworkv1.BastionHost] {
 	if s.IsAzureBastionEnabled() {
 		subnetID := azure.SubnetID(s.SubscriptionID(), s.ResourceGroup(), s.Vnet().Name, s.AzureBastion().Subnet.Name)
 		publicIPID := azure.PublicIPID(s.SubscriptionID(), s.ResourceGroup(), s.AzureBastion().PublicIP.Name)
 
 		return &bastionhosts.AzureBastionSpec{
 			Name:            s.AzureBastion().Name,
+			Namespace:       s.Namespace(),
 			ResourceGroup:   s.ResourceGroup(),
 			Location:        s.Location(),
 			ClusterName:     s.ClusterName(),
diff --git a/azure/services/bastionhosts/spec.go b/azure/services/bastionhosts/spec.go
index f6586599668..b02c289af60 100644
--- a/azure/services/bastionhosts/spec.go
+++ b/azure/services/bastionhosts/spec.go
@@ -21,16 +21,17 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v4"
-	"github.com/pkg/errors"
+	asonetworkv1 "github.com/Azure/azure-service-operator/v2/api/network/v1api20220701"
+	"github.com/Azure/azure-service-operator/v2/pkg/genruntime"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/ptr"
 	infrav1 "sigs.k8s.io/cluster-api-provider-azure/api/v1beta1"
-	"sigs.k8s.io/cluster-api-provider-azure/azure/converters"
 )
 
 // AzureBastionSpec defines the specification for azure bastion feature.
 type AzureBastionSpec struct {
 	Name            string
+	Namespace       string
 	ResourceGroup   string
 	Location        string
 	ClusterName     string
@@ -47,62 +48,62 @@ type AzureBastionSpecInput struct {
 	VNetName     string
 }
 
-// ResourceName returns the name of the bastion host.
-func (s *AzureBastionSpec) ResourceName() string {
-	return s.Name
-}
-
-// ResourceGroupName returns the name of the resource group.
-func (s *AzureBastionSpec) ResourceGroupName() string {
-	return s.ResourceGroup
-}
-
-// OwnerResourceName is a no-op for bastion hosts.
-func (s *AzureBastionSpec) OwnerResourceName() string {
-	return ""
+// ResourceRef implements azure.ASOResourceSpecGetter.
+func (s *AzureBastionSpec) ResourceRef() *asonetworkv1.BastionHost {
+	return &asonetworkv1.BastionHost{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      s.Name,
+			Namespace: s.Namespace,
+		},
+	}
 }
 
 // Parameters returns the parameters for the bastion host.
-func (s *AzureBastionSpec) Parameters(ctx context.Context, existing interface{}) (parameters interface{}, err error) {
-	if existing != nil {
-		if _, ok := existing.(armnetwork.BastionHost); !ok {
-			return nil, errors.Errorf("%T is not an armnetwork.BastionHost", existing)
-		}
+func (s *AzureBastionSpec) Parameters(ctx context.Context, existingBastionHost *asonetworkv1.BastionHost) (parameters *asonetworkv1.BastionHost, err error) {
+	if existingBastionHost != nil {
 		// bastion host already exists
-		return nil, nil
+		return existingBastionHost, nil
 	}
 
 	bastionHostIPConfigName := fmt.Sprintf("%s-%s", s.Name, "bastionIP")
 
-	return armnetwork.BastionHost{
-		Name:     ptr.To(s.Name),
-		Location: ptr.To(s.Location),
-		Tags: converters.TagsToMap(infrav1.Build(infrav1.BuildParams{
-			ClusterName: s.ClusterName,
-			Lifecycle:   infrav1.ResourceLifecycleOwned,
-			Name:        ptr.To(s.Name),
-			Role:        ptr.To("Bastion"),
-		})),
-		SKU: &armnetwork.SKU{
-			Name: ptr.To(armnetwork.BastionHostSKUName(s.Sku)),
-		},
-		Properties: &armnetwork.BastionHostPropertiesFormat{
+	return &asonetworkv1.BastionHost{
+		Spec: asonetworkv1.BastionHost_Spec{
+			AzureName: s.Name,
+			Location:  ptr.To(s.Location),
+			Tags: infrav1.Build(infrav1.BuildParams{
+				ClusterName: s.ClusterName,
+				Lifecycle:   infrav1.ResourceLifecycleOwned,
+				Name:        ptr.To(s.Name),
+				Role:        ptr.To("Bastion"),
+			}),
+			Sku: &asonetworkv1.Sku{
+				Name: ptr.To(asonetworkv1.Sku_Name(s.Sku)),
+			},
 			EnableTunneling: ptr.To(s.EnableTunneling),
-			DNSName:         ptr.To(fmt.Sprintf("%s-bastion", strings.ToLower(s.Name))),
-			IPConfigurations: []*armnetwork.BastionHostIPConfiguration{
+			DnsName:         ptr.To(fmt.Sprintf("%s-bastion", strings.ToLower(s.Name))),
+			IpConfigurations: []asonetworkv1.BastionHostIPConfiguration{
 				{
 					Name: ptr.To(bastionHostIPConfigName),
-					Properties: &armnetwork.BastionHostIPConfigurationPropertiesFormat{
-						Subnet: &armnetwork.SubResource{
-							ID: &s.SubnetID,
+					Subnet: &asonetworkv1.BastionHostSubResource{
+						Reference: &genruntime.ResourceReference{
+							ARMID: s.SubnetID,
 						},
-						PublicIPAddress: &armnetwork.SubResource{
-							ID: &s.PublicIPID,
+					},
+					PublicIPAddress: &asonetworkv1.BastionHostSubResource{
+						Reference: &genruntime.ResourceReference{
+							ARMID: s.PublicIPID,
 						},
-						PrivateIPAllocationMethod: ptr.To(armnetwork.IPAllocationMethodDynamic),
 					},
+					PrivateIPAllocationMethod: ptr.To(asonetworkv1.IPAllocationMethod_Dynamic),
 				},
 			},
 		},
 	}, nil
 }
+
+// WasManaged implements azure.ASOResourceSpecGetter.
+func (s *AzureBastionSpec) WasManaged(resource *asonetworkv1.BastionHost) bool {
+	// returns always returns true as CAPZ does not support BYO bastion.
+	return true
+}