Azure Virtual Machine: Unable to connect through RDP after enabling Network Security Group rules

Next checks should focus on proving where the block occurs.

1. Use Network Watcher > IP flow verify first.
   • In Azure portal, open Network Watcher.
   • Go to IP flow verify.
   • Select the affected VM and its primary NIC.
   • Set Protocol to TCP.
   • Set Direction to Inbound.
   • Set Local port to 3389.
   • Set Local IP address to the VM private IP.
   • Set Remote IP address to the public IP of the client network being used.
   • Use any remote port such as 60000.
   • Select Check.
   Expected result:
   • If it shows Denied, the output also shows the NSG rule causing the block.
   • If it shows Allowed, the NSG path is likely correct and the issue is more likely inside the VM or elsewhere in networking.
2. Review Effective security rules on the VM NIC.
   • Go to Virtual Machines > select the VM.
   • Open Networking > Network settings.
   • Select the NIC name.
   • Under Help, open Effective security rules.
   • Check inbound rules affecting TCP 3389.
   Verify these points:
   • An Allow rule exists for 3389/TCP.
   • The allow rule has a higher priority than any matching deny rule. In Azure, lower number = higher priority.
   • If NSGs exist on both subnet and NIC, RDP must be allowed by both.
3. Check for common NSG misconfigurations.
   • A broad deny rule with a higher priority can override the RDP allow rule.
   • A subnet NSG may allow RDP while the NIC NSG still blocks it, or the reverse.
   • The source IP restriction may be too narrow. If the inbound rule allows only one source IP, confirm the current client public IP exactly matches that rule.
4. If NSG checks pass, reset the RDP configuration from Azure. Since the VM is running and port 3389 has already been reviewed, the next Azure-side test is to reset the RDP configuration:
   • In Azure portal, open the VM.
   • In the Help section, select Reset password.
   • Set Mode to Reset configuration only.
   • Select Update.
   This is the documented step when Remote Connections are disabled or Windows Firewall rules are blocking RDP.
5. If needed, reset credentials separately. If the connection reaches the VM but fails at sign-in, use the same Reset password area and choose Reset password mode to set a known local administrator password.
6. Continue with Azure VM checks if RDP still fails.
   • Review Boot diagnostics for startup issues.
   • Check Resource health and confirm the VM reports Available.
   • If still unresolved, try Redeploy. Risk: redeploy can cause ephemeral disk data loss and dynamic IP addresses associated with the VM are updated.
7. Also confirm the basic access path.
   • If the Connect button is grayed out and there is no Express Route or Site-to-Site VPN, the VM needs a public IP address for direct RDP.
   • Verify local network equipment such as routers or firewalls is not blocking outbound TCP 3389.

A practical decision path is:

• IP flow verify = Denied → fix NSG rule, priority, subnet/NIC conflict, or source IP restriction.
• IP flow verify = Allowed but RDP still fails → use Reset configuration only, then check credentials, boot diagnostics, and resource health.

The question about the external company is outside scope.

References:

• Troubleshoot RDP blocked by NSG rules on Azure Windows VMs
• Troubleshoot Remote Desktop connections to an Azure virtual machine