Question
You have an Azure virtual machine named VM1 that has a private IP address only.
You configure the Windows Admin Center extension on VM1.
You have an on-premises computer that runs Windows 11. You use the computer for server management.
You need to ensure that you can use Windows Admin Center from the Azure portal to manage VM1.
What should you configure?
- A. an Azure Bastion host on the virtual network that contains VM1.
- B. a VPN connection to the virtual network that contains VM1. Correct
- C. a private endpoint on the virtual network that contains VM1.
- D. a network security group (NSG) rule that allows inbound traffic on port 443.
Explanation
Windows Admin Center in the Azure portal connects from your browser to the VM's IP address on the port where Windows Admin Center is installed. VM1 has only a private IP address, so the on-premises Windows 11 management computer needs network access to the virtual network that contains VM1. A VPN connection, such as a point-to-site or site-to-site VPN through a VPN gateway, provides that access. Connecting through a private IP address needs no inbound NSG rule; an inbound rule (port 6516 by default, not 443) is needed only for a public IP address, which VM1 does not have. Azure Bastion is not supported with Windows Admin Center in the Azure portal, and a private endpoint is for Azure PaaS services, not for reaching a VM.
