Remote Desktop Protocol (RDP) is a vital tool for managing Windows Servers across both cloud and on-premises environments. However, exposing management ports directly to the public internet creates a massive security vulnerability. To solve this, administrators can use Azure Bastion, which is a fully managed platform service that provides secure RDP access over SSL. This service allows users to connect to virtual machines directly through the Azure portal without assigning public IP addresses to those servers.
A system architecture diagram showing a user connecting via SSL through the Azure portal to Azure Bastion, which then routes RDP traffic over TCP port 3389 to a target virtual machine that has no public IP address.
Controlling the flow of network traffic is essential for restricting unauthorized remote access. Administrators configure Network Security Groups (NSGs) to act as virtual firewalls, creating inbound rules that restrict TCP port 3389 to known, trusted IP addresses. To reduce exposure even further, Just-in-Time (JIT) VM Access can be enabled to lock down RDP ports by default. This control keeps the inbound port closed until an approved user requests access, opening it only for a brief, defined time window.
Securing the identity of the user is just as important as securing the network path. Administrators can enforce Microsoft Entra Multifactor Authentication to require extra verification steps, such as a mobile app prompt or a text message, before granting access. By using Conditional Access Policies, organizations can restrict RDP sessions based on factors like device compliance or user risk. For hybrid environments, deploying the NPS extension allows Windows Servers to integrate with Entra MFA to enforce these security checks.
When an RDP connection fails, administrators must systematically isolate the cause of the blockage. The first step is to verify that the target virtual machine is in a running state in the Azure portal. Next, administrators should inspect the NSG inbound rules to ensure they allow TCP traffic on port 3389 from the client's network. Finally, if the connection does not use Azure Bastion, verify that the virtual machine has a properly assigned and configured public IP address.
Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Prepare and test your skills
Prepare and test your skills
Azure Bastion is a fully managed platform service that provides secure RDP connectivity over SSL directly through the Azure portal. This allows users to connect to virtual machines without exposing management ports to the public internet or assigning public IP addresses to those servers.
Just-in-Time (JIT) VM Access locks down RDP ports by default to minimize security exposure. It keeps the inbound port closed until an approved user requests access, opening it only for a brief, defined time window.
Administrators should first verify in the Azure portal that the target virtual machine is in a running state. Next, they must check the Network Security Group (NSG) inbound rules to ensure TCP traffic on port 3389 is allowed from the client network, and confirm that the virtual machine has a properly configured public IP address if Azure Bastion is not being used.
StudyCerts
StudyCerts