Question

Your company hosts several Windows VMs in a virtual network. Security policy prohibits assigning public IP addresses to any VM and forbids opening inbound RDP (port 3389) from the internet on NSGs. Administrators still need secure RDP access to these VMs directly from the Azure portal. Which solution meets these requirements with the least administrative effort?

Accepted Answer

Deploy Azure Bastion into a subnet named AzureBastionSubnet in the VNet and connect to the VMs through the portal

Answer

Assign a public IP to each VM and create NSG rules that allow port 3389 only from the corporate IP range

Answer

Deploy a jump box VM with a public IP and RDP from it to the other VMs over the private network

Answer

Create a point-to-site VPN gateway and require administrators to connect the VPN before using RDP