Connect to Azure VM via RDP

How RDP Works

RDP is a Microsoft protocol that transmits a live graphical desktop session over the network. When you connect via RDP:

1. Your RDP client connects to port 3389 on the VM's public IP
2. The connection is encrypted using TLS
3. You authenticate with the VM's administrator username and password
4. The Windows desktop renders on your screen — input goes to the VM, display comes back to you

Before You Connect

• VM is running (not deallocated)
• Port 3389 is open in the VM's Network Security Group
• You have the VM's public IP address
• You have the administrator username and password

az vm show \
  --resource-group myResourceGroup \
  --name myWindowsVM \
  --show-details \
  --query publicIps \
  --output tsv

Connect from Windows

Windows has Remote Desktop Connection built in — no installation needed.

Method 1 — Run Dialog (Fastest)

1. Press Win + R
2. Type mstsc and press Enter
3. In the "Computer" field, enter the VM's public IP address
4. Click Connect
5. Enter your administrator username and password
6. Click Yes on the certificate warning

Method 2 — Command Line

# Open RDP to a specific IP
mstsc /v:4.188.23.45

# Open RDP in full screen
mstsc /v:4.188.23.45 /f

# Open RDP with specific screen resolution
mstsc /v:4.188.23.45 /w:1920 /h:1080

Connect from Mac

Download Microsoft Remote Desktop from the Mac App Store — it's free and maintained by Microsoft.

1. Open the App Store and search for Microsoft Remote Desktop
2. Install and open it
3. Click Add PC
4. Enter the VM's public IP in "PC Name"
5. Under "User account", click the dropdown → Add User Account
6. Enter your administrator username and password
7. Click Add, then double-click the PC to connect

Connect from Linux

Linux doesn't have a built-in RDP client, but several open-source options are available:

# Install Remmina (popular Linux RDP client)
sudo apt update
sudo apt install -y remmina remmina-plugin-rdp

# Or use FreeRDP (command-line RDP client)
sudo apt install -y freerdp2-x11

# Connect via FreeRDP
xfreerdp /v:4.188.23.45 /u:azureuser /p:YourPassword /f

Using the RDP File from Azure Portal

The easiest way to connect — the Azure Portal generates a pre-configured .rdp file:

1. Go to your VM in the Azure Portal
2. Click Connect in the top menu
3. Select RDP
4. Verify the IP address and port (3389)
5. Click Download RDP File
6. Open the downloaded file — your RDP client launches automatically
7. Enter your administrator credentials when prompted

Security — Hardening RDP Access

Port 3389 open to the internet is a significant security risk. Automated bots constantly scan the internet for open RDP ports and attempt to brute-force credentials. Here's how to harden your setup:

Option 1 — Restrict NSG to Your IP Only

The simplest hardening — change the NSG rule so only your specific IP can reach port 3389.

# First find your public IP
curl https://api.ipify.org

# Update the NSG rule to allow only your IP
az network nsg rule update \
  --resource-group myResourceGroup \
  --nsg-name myVM-nsg \
  --name RDP \
  --source-address-prefixes 103.45.67.89  # Replace with your IP

Option 2 — Use Azure Bastion (Best Practice)

Azure Bastion eliminates the need to open port 3389 entirely. Covered in detail in the next section.

Option 3 — Just-in-Time (JIT) VM Access

Microsoft Defender for Cloud's JIT feature keeps port 3389 closed by default. When you need to connect, you request access through the portal — it opens port 3389 for your IP for a limited time (e.g., 3 hours), then closes it automatically.

Azure Bastion for RDP

Azure Bastion provides RDP access through your browser — no open port 3389, no public IP required on the VM.

1. Deploy Azure Bastion to your VNet (one-time setup)
2. In the Azure Portal, go to your VM → Connect → Bastion
3. Enter the administrator username and password
4. Click Connect — an RDP session opens directly in your browser tab

Troubleshooting RDP Issues

Can't connect — Connection refused or timeout

• Is the VM running? Check in the portal — it may be deallocated
• Is port 3389 open in the NSG? Check inbound rules
• Is the NSG rule restricted to a specific IP that no longer matches yours? (ISPs sometimes change your IP)
• Is the public IP correct? Dynamic IPs can change when a VM is deallocated and restarted

Wrong credentials — Login failed

• Double-check your username — common mistake is typing "admin" (which Azure blocks)
• If you forgot the password, reset it in the portal: VM → Reset password under Support + Troubleshooting

Certificate error / Remote desktop can't connect

• This is normal — accept the self-signed certificate warning
• If the error persists, the VM's RDP service may need restarting — use the Azure Serial Console

az vm user update \
  --resource-group myResourceGroup \
  --name myWindowsVM \
  --username azureuser \
  --password "NewSecureP@ssword123!"