Azure VM connectivity issues follow a very similar pattern to AWS — Network Security Groups (NSGs), the VM’s own OS firewall, and the actual VM state all need checking, in that order.
Common Symptoms
- RDP/SSH connection times out
- “Unable to connect” from the Azure portal’s Connect option
- Connection worked previously and stopped after a configuration change
Possible Causes
- Network Security Group missing or blocking the required inbound rule
- The VM is deallocated or stopped
- The VM’s own OS-level firewall blocking the port
- A Just-in-Time VM access policy requiring a request before connecting
Before You Begin
Method 1 — Confirm VM status
Method 2 — Review the Network Security Group
Check inbound rules
Open Networking on the VM resource and confirm an NSG rule allows the required port from your source IP.
Method 3 — Check for Just-in-Time access
Confirm JIT VM access status
If Microsoft Defender for Cloud’s Just-in-Time VM access is enabled, you need to request access before connecting — the port stays closed until a request is approved.
Method 4 — Use Serial Console if fully locked out
Access without network connectivity
The Azure Serial Console (under Help in the VM blade) gives you a text-based connection to the VM independent of its network configuration, useful for checking or resetting the OS firewall.
Frequently Asked Questions
What is Just-in-Time VM access and why does it block me?
It’s a security feature that keeps management ports closed by default and only opens them temporarily after an approved request — it’s a deliberate extra layer, not a misconfiguration, if your organization has enabled it.
Conclusion
Checking VM run state, the Network Security Group, and Just-in-Time access policy — in that order — resolves the majority of Azure VM connectivity issues.
Related Articles
