issues connecting via RDP to a new Virtual Machine in Azure

Question

issues connecting via RDP to a new Virtual Machine in Azure

Amato, Andy 85

Just recently created a new VM in an existing resource group. I am having trouble using RDP to get into the VM using the private IP. However, as a troubleshooting steps I attached a public ip and successfully log in via the public means. I want to be able to remove the public ip and only log in via the private ip. But, i can't do that until i resolve the RDP issue. Can someone help me address this issue?

Amato, Andy 85 Reputation points

2025-11-21T19:11:47.69+00:00

I have tried the above steps as recommended. I would like to be connected to a human to review this issue.
Venkatesan S 925 Reputation points Microsoft External Staff Moderator

2025-11-21T22:09:31.2033333+00:00
Hi Amato, Andy,

Thanks for reaching out in Microsoft Q&A,

To access your VM using its private IP, the connection must originate from a network that is directly connected to the Azure VNet. Private IP communication is not exposed over the internet. Because of this, you will need to establish a secure private connection between your on-premises environment and Azure.

Azure provides several options depending on your scenario:

Azure VPN Gateway

Azure ExpressRoute

Azure Virtual WAN

Ensure that the Network Security Groups (NSGs) and the VM’s firewall allow inbound RDP traffic (TCP port 3389) from authorized IP addresses on the private network. Compare the new VM’s NIC, NSG, and subnet configuration with one of your existing VMs that can successfully accept RDP connections.

Check the Windows Firewall on the new VM while you are connected using the temporary public IP.

Review the effective routes on the VM’s NIC to ensure there are no routing conflicts.

If you prefer not to set up VPN, Azure Bastion enables secure RDP/SSH access over the Azure portal without exposing a public IP on the VM.

Reference:

About Azure VPN Gateway | Microsoft Learn

Azure ExpressRoute Overview: Connect over a private connection | Microsoft Learn

Azure Virtual WAN Overview | Microsoft Learn

About Azure Bastion | Microsoft Learn

Similar threads:

Unable to connect to Azure VM using Private IP Address after setting up Point to Site VPN - Microsoft Q&A

Private IP VM connection to RDP with out using firwall public IP - Microsoft Q&A

Kindly let us know if the above helps or you need further assistance on this issue.

Answer accepted by question author

1 additional answer

Your answer

Amato, Andy 85 Reputation points

2025-11-21T19:11:47.69+00:00

I have tried the above steps as recommended. I would like to be connected to a human to review this issue.
Venkatesan S 925 Reputation points Microsoft External Staff Moderator

2025-11-21T22:09:31.2033333+00:00

Hi Amato, Andy,

Thanks for reaching out in Microsoft Q&A,

To access your VM using its private IP, the connection must originate from a network that is directly connected to the Azure VNet. Private IP communication is not exposed over the internet. Because of this, you will need to establish a secure private connection between your on-premises environment and Azure.

Azure provides several options depending on your scenario:

Azure VPN Gateway

Azure ExpressRoute

Azure Virtual WAN

Ensure that the Network Security Groups (NSGs) and the VM’s firewall allow inbound RDP traffic (TCP port 3389) from authorized IP addresses on the private network. Compare the new VM’s NIC, NSG, and subnet configuration with one of your existing VMs that can successfully accept RDP connections.

Check the Windows Firewall on the new VM while you are connected using the temporary public IP.

Review the effective routes on the VM’s NIC to ensure there are no routing conflicts.

If you prefer not to set up VPN, Azure Bastion enables secure RDP/SSH access over the Azure portal without exposing a public IP on the VM.

Reference:

About Azure VPN Gateway | Microsoft Learn

Azure ExpressRoute Overview: Connect over a private connection | Microsoft Learn

Azure Virtual WAN Overview | Microsoft Learn

About Azure Bastion | Microsoft Learn

Similar threads:

Unable to connect to Azure VM using Private IP Address after setting up Point to Site VPN - Microsoft Q&A

Private IP VM connection to RDP with out using firwall public IP - Microsoft Q&A

Kindly let us know if the above helps or you need further assistance on this issue.

Answer 1

Adam Zachary 2,025

Typically, when RDP works with a public IP but fails with the private IP, it means the VM itself is fine and the problem is in the network path. There are only a few things that block private-IP RDP in Azure.

The first thing to check is whether the machine you are connecting from actually has a route to that private IP. You must be on the same VNet, a peered VNet, connected over VPN, or connected through ExpressRoute. If none of those are true, private-IP RDP will never work.

Second, check the NSG on both the subnet and the VM NIC. You need an inbound rule allowing TCP 3389 from your source network. Many people only check the subnet NSG and forget the NIC NSG is also blocking it.

Third, if you are using Azure Firewall or a custom NVA, make sure they allow RDP and that the route table for the VM points to the correct next hop. A wrong UDR (for example pointing 0.0.0.0/0 at a firewall that does not allow RDP) will block private-IP access immediately.

So the quick steps are:

Make sure your client can actually reach the VM’s private IP (same VNet, VPN, or peering).

Check the NIC NSG and subnet NSG and make sure 3389 inbound is allowed from your network.

Check the route table for the VM if you are using Azure Firewall or UDRs.

Once RDP works privately, remove the public IP.

This is always a network path issue, not a VM issue. If you check those three things, you will find the blocker.

Amato, Andy 85 Reputation points

2025-11-21T21:01:16+00:00

thanks for those details. to further clarify on this issue. I can successfully ping the device over the network on local LAN. I do agree with you that it's something with the network path. For further context. I have other vm's on the very same VNet and i can RDP without issue to those other vm's. These vm's have been on the network for a long time. This just happens to be a new vm in an already existing environment. As my next troubleshooting steps, I plan to just try and manually assign a different local ip to that vm and see if that changes things for me. I won't get a chance to look at this until next week at this point. But, i will report back. Not sure if you might be available next week to look over on a remote session. Thanks again for the help and I will be in touch.
Adam Zachary 2,025 Reputation points

2025-11-21T21:16:40.8033333+00:00

Thanks for the extra details. Since you can ping the VM over the LAN and other VMs on the same VNet allow RDP, that confirms the VNet itself is fine.

When only the new VM refuses private-IP RDP, it almost always comes down to one of two things:

The NIC-level NSG is blocking 3389, even if the subnet NSG is correct.

A bad route or security profile was auto-applied only to this VM (for example Defender for Cloud JIT, a custom extension, or a stray UDR on the NIC).

Before changing the private IP, check these two items first because they are the most common causes for brand-new VMs:

• Go to the VM → Networking → NIC Network Security Group and make sure inbound TCP 3389 is allowed from your source network. • Check the “Effective Routes” on the NIC. If you see a next hop pointing to a Firewall or NVA that does not allow RDP, that will block you even though ping works.

If everything looks correct, then trying a different private IP is a good next step, occasionally an IP gets tied to an old stale rule or a deny entry from a previous resource.

And yes, feel free to reach back out next week with what you find. I can help you narrow it down once you have the results.
Amato, Andy 85 Reputation points

2025-11-25T19:40:53.0066667+00:00

thanks for those details. i checked those things and they seemed to be fine. Another note about this vm i am also able to ping out from the new vm to internal resources as expected. I did go ahead and statically assign an available ip to that vm inside windows and now i seemed to have bricked myself out of the vm all together. Currently i'm waiting for AZure redploy tool to run and see if that helps. It's been running 8 minutes now.
Adam Zachary 2,025 Reputation points

2025-11-25T19:46:02.2633333+00:00
It sounds like the static IP change inside Windows is what locked you out.

When you set the IP manually inside the OS, it no longer matches the IP Azure assigned to the NIC, so Azure sees the VM at one address while the guest OS is sitting on another.

That breaks RDP immediately and can also break the redeploy if networking inside the VM is misconfigured.

Redeploy won’t fix the guest OS network settings. It only moves the VM to new host hardware.

Once redeploy completes, go to:

VM → Operations → Run Command → RunPowerShellScript

and run something like:

Get-NetIPAddress

If the VM is alive, you’ll see the wrong static IP. Then reset it back to DHCP:

netsh interface ip set address "Ethernet" dhcp

(Or whichever adapter name shows up.)

Once the NIC inside Windows is back on DHCP, it will pick up the Azure-assigned private IP again and RDP should come back.

If Run Command also fails, reset the NIC from Azure:

VM → Networking → “Reset NIC”

That usually restores access.
Amato, Andy 85 Reputation points

2025-11-25T19:49:05.1266667+00:00

thanks and will do. the redeploy has been running 16 minutes. How long would you wait before attempting your steps above?
Adam Zachary 2,025 Reputation points

2025-11-25T19:52:48.14+00:00

I’ve seen redeploy hang anywhere from a few minutes to over half an hour depending on backend load, so sixteen minutes is still normal. I would give it about 30 minutes total.

If it’s still running after that, assume it’s stuck and go ahead with the Run Command steps to reset the NIC back to DHCP. That’s the part that will actually bring the VM back, since redeploy won’t fix the guest OS IP mismatch.
Amato, Andy 85 Reputation points

2025-11-25T21:41:46.4866667+00:00

I keep trying to run the commands you instructed but it seems to run very slow and never seems to produce a result. the vm seems stuck.
Amato, Andy 85 Reputation points

2025-11-25T21:58:32.8466667+00:00

perhaps there is another way to reset the vm back to dhcp?
Amato, Andy 85 Reputation points

2025-11-25T22:02:20.62+00:00

okay, so i managed to get into the vm by setting the static ip in Azure as well as in windows with the same ip. I think i'm ready now to remove the public ip. Will test this out in the morning.
Adam Zachary 2,025 Reputation points

2025-11-25T22:06:18.43+00:00

Nice work.

Since the VM is stable now and RDP works privately, you’re in a good spot
Amato, Andy 85 Reputation points

2025-11-26T14:52:11.08+00:00

ya, all good here now. Thanks again for all the help. you can close this out if that's a thing. :-)
Venkatesan S 925 Reputation points Microsoft External Staff Moderator

2025-11-26T15:00:31.67+00:00

Hi Amato, Andy

If the issue is resolved.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

To resolve the RDP connection issue to your Azure VM using the private IP address, you can follow these troubleshooting steps:

Check Network Security Group (NSG) Rules: Ensure that the NSG associated with your VM allows inbound traffic on TCP port 3389, which is the default port for RDP. If there are any rules blocking this port, you will need to modify them.
Verify Local Network Equipment: Make sure that local network equipment such as routers and firewalls are not blocking outbound TCP port 3389. This can prevent you from connecting to the VM using its private IP.
Reset Remote Desktop Configuration: Sometimes, resetting the Remote Desktop configuration on the VM can help. You can do this through the Azure portal or using PowerShell commands.
Review VM Resource Health: Check the health of the VM in the Azure portal to ensure there are no underlying issues affecting connectivity.
Restart the VM: If the above steps do not resolve the issue, try restarting the VM to refresh its network settings.
Check the VM Console Logs: Reviewing the console logs can provide insights into any errors or issues that might be affecting the RDP service.

If you have followed these steps and are still unable to connect via the private IP, consider checking if the VM's private IP address has changed, as this could affect your connection attempts. You can also try connecting from another machine within the same virtual network to rule out local network issues.

References:

Share via

issues connecting via RDP to a new Virtual Machine in Azure

1 additional answer

Your answer