VM

If you’re running VMs in Azure, you will usually need to either RDP or SSH to the VM to resolve issues, install software or perform other administrative tasks. You can do this by opening the inbound port on your NSG and connecting directly to your VM. This will work, but leaving that port open invites brute-force attacks to compromise your VMs. Cloud services are an easy target for attackers looking for open ports, and it’s not uncommon to see attempts at brute force attacks within hours of a VM being deployed with an open port.

Most VM-based workloads in Azure are either running 24/7 or are scaled up and down dynamically as load changes. However, there are a class of workloads that fall in between these two scenarios, where you are running machines for reasonable periods, but there are periods where they are not in use and you would like to be able to turn them off during that period, but retaining state is a problem.