Can’t RDP or SSH to an Azure VM

Keep the VM running for both breaks.

1Break it: your IP changed

Home and office internet IPs change. Simulate it by pointing the rule at a different address:

az network nsg rule update --resource-group rg-saat-l61 --nsg-name vm-winNSG --name allow-rdp-me --source-address-prefixes 203.0.113.10 -o none
Test-NetConnection $ip -Port 3389 -WarningAction SilentlyContinue | Select-Object RemoteAddress, TcpTestSucceeded
az network watcher test-ip-flow --resource-group rg-saat-l61 --vm vm-win --direction Inbound --protocol TCP --local "${priv}:3389" --remote "${myIp}:50000" -o table

You should see something like this:

RemoteAddress  TcpTestSucceeded
-------------  ----------------
20.x.x.x                  False

Access    RuleName
--------  ----------------------------------
Deny      defaultSecurityRules/DenyAllInBound

TCP fails and Azure says Deny, naming the default rule. The NSG doesn’t know your current IP. Resetting the password or restarting the VM would change nothing.

Fix it: update the rule to your current IP, then test again:

$myIp = (Invoke-RestMethod https://api.ipify.org)
az network nsg rule update --resource-group rg-saat-l61 --nsg-name vm-winNSG --name allow-rdp-me --source-address-prefixes $myIp -o none
Test-NetConnection $ip -Port 3389 -WarningAction SilentlyContinue | Select-Object RemoteAddress, TcpTestSucceeded

TcpTestSucceeded is True again. For people whose IP changes often, Bastion or just-in-time access is the lasting fix.

2Break it: Azure allows it, the VM doesn’t

Someone “hardens” the server and disables the Remote Desktop firewall rules inside Windows:

az vm run-command invoke --resource-group rg-saat-l61 --name vm-win --command-id RunPowerShellScript --scripts 'Disable-NetFirewallRule -Name RemoteDesktop-UserMode-In-TCP,RemoteDesktop-UserMode-In-UDP' --query "value[0].message" -o tsv
Test-NetConnection $ip -Port 3389 -WarningAction SilentlyContinue | Select-Object RemoteAddress, TcpTestSucceeded
az network watcher test-ip-flow --resource-group rg-saat-l61 --vm vm-win --direction Inbound --protocol TCP --local "${priv}:3389" --remote "${myIp}:50000" -o table

You should see something like this:

RemoteAddress  TcpTestSucceeded
-------------  ----------------
20.x.x.x                  False

Access    RuleName
--------  ---------------------------
Allow     securityRules/allow-rdp-me

Azure says Allow, yet TCP fails. The packet reaches the VM and something inside drops it. That rules out the whole Azure network in one step.

Check the guest firewall and the listener from outside, then fix it:

az vm run-command invoke --resource-group rg-saat-l61 --name vm-win --command-id RunPowerShellScript --scripts 'Get-NetFirewallRule -Name RemoteDesktop-UserMode-In-TCP | Select-Object Name, Enabled; Get-NetTCPConnection -LocalPort 3389 -State Listen | Select-Object LocalPort, State' --query "value[0].message" -o tsv
az vm run-command invoke --resource-group rg-saat-l61 --name vm-win --command-id RunPowerShellScript --scripts 'Enable-NetFirewallRule -Name RemoteDesktop-UserMode-In-TCP,RemoteDesktop-UserMode-In-UDP' --query "value[0].message" -o tsv
Test-NetConnection $ip -Port 3389 -WarningAction SilentlyContinue | Select-Object RemoteAddress, TcpTestSucceeded

You should see something like this:

Name                            Enabled
----                            -------
RemoteDesktop-UserMode-In-TCP     False

LocalPort  State
---------  -----
     3389 Listen

RemoteAddress  TcpTestSucceeded
-------------  ----------------
20.x.x.x                   True

The service was listening all along; only the firewall rule was off. After enabling it, RDP works again.

3Clean up

Delete the lab resource group:

az group delete --name rg-saat-l61 --yes

✅ Checkpoint: You told an NSG block from a guest firewall block with two commands, and fixed both without logging in.