To improve security with our solutions, we use VNets on all our Azure subscriptions and do not expose remote desktop port (3389) publicly. Since internal endpoints are only reachable within a Cloud Service, this reduce the possible surface of attack. Connect to Cloud Services