You have an Azure virtual machine named VM1 that has a private IP address only. You configure the Windows Admin Center extension on VM1. You have an…

To manage an Azure virtual machine using the Windows Admin Center (WAC) extension in the Azure portal, the browser on the management computer must have direct network connectivity to the target VM's IP address. Since the VM in this scenario only has a private IP address, a connection must be established between the on-premises network and the Azure virtual network. A site-to-site VPN or an ExpressRoute circuit provides this required network path, allowing the on-premises computer's browser to resolve and connect to the VM's private IP address, thereby enabling management through the WAC portal interface.

A. an Azure Bastion host on the virtual network that contains VM1.

Azure Bastion provides secure RDP and SSH connectivity to VMs through the Azure portal. It does not facilitate the web-based traffic required for the Windows Admin Center extension.

C. a network security group (NSG) rule that allows inbound traffic on port 443.

An NSG rule only filters traffic; it does not create a network path. Since the VM has no public IP, a rule for internet traffic is ineffective.

D. a private endpoint on the virtual network that contains VM1.

A private endpoint is used to securely connect to Azure PaaS services from within a virtual network, not to provide external management access to a VM.

1. Microsoft Learn. "Use Windows Admin Center in the Azure portal to manage a Windows Server VM". Windows Server Documentation. Under the "Connectivity" section

it states

"To connect to a VM

your browser needs to be able to reach its private IP address... If you're connecting over the private IP address

you'll need a VPN connection to the virtual network of the VM."

2. Microsoft Learn. "What is VPN Gateway?". Azure Documentation. This document explains that Azure VPN Gateway extends on-premises networks to Azure virtual networks over a site-to-site VPN tunnel

which provides the necessary connectivity for this scenario.

3. Microsoft Learn. "What is Azure Bastion?". Azure Documentation. This source clarifies that Azure Bastion is a PaaS service for secure RDP/SSH access

confirming it is not the correct tool for enabling WAC connectivity.

4. Microsoft Learn. "What is a private endpoint?". Azure Documentation. This document details the function of private endpoints

confirming they are used for inbound connections to PaaS services

not for IaaS VM management from an external location.