Updated October 2026: Azure Cloud Services (classic), which this guide was written for in 2014, was retired on August 31, 2024. Its successor, Cloud Services (extended support), is scheduled to retire on March 31, 2027. The original steps are kept below for reference; the section that follows explains what to use now.
Quick Answer: Remote Desktop on Azure in 2026
- Azure virtual machines: RDP is built in. Connect from the VM's Connect blade in the portal. Don't open port 3389 to the whole internet: allow only your own IP in the network security group, use Azure Bastion (RDP in the browser or native client with no public port), or enable just-in-time VM access in Microsoft Defender for Cloud.
- Cloud Services (extended support): RDP is enabled per role through the Remote Desktop extension in the portal (or in the deployment template), instead of the
RemoteAccess/RemoteForwardermodules and uploaded certificates used below. Plan a migration before the March 2027 retirement; Microsoft points to Azure Service Fabric managed clusters, App Service, Azure Container Apps or virtual machine scale sets, depending on the workload. - Looking for "Azure Remote Desktop Services" for users? That is a different product: Azure Virtual Desktop, which delivers Windows desktops and apps to employees. It isn't used to manage servers.
Example: allow RDP to a VM safely with the Azure CLI
# Azure CLI: allow RDP to a VM only from your own public IP (never from "Any")
az network nsg rule create --resource-group MyRg --nsg-name MyVmNsg --name AllowRdpFromMyIp \
--priority 1000 --direction Inbound --access Allow --protocol Tcp \
--destination-port-ranges 3389 --source-address-prefixes 203.0.113.10/32
# Or skip the public port entirely and connect through Azure Bastion
az network bastion rdp --resource-group MyRg --name MyBastion \
--target-resource-id $(az vm show -g MyRg -n MyVm --query id -o tsv)Original Guide: RDP for Cloud Services (Classic)
Background
If you are running a Cloud Service Worker Role, it's best to have Remote Desktop enabled so you can go onto the running instance of the server and see files, configuration and other aspects of the deployment. It helps in debugging and should be available for all Cloud Services. If you are deploying through automation, you will have to do some extra steps to get it working.
Steps
There are different ways to set it up. One of the fastest ways is to use Visual Studio to make the certificate for you. Open up the solution in Visual Studio, right click the Azure project and click Publish and select the subscription.
On the next page, select "Enable Remote Desktop for all roles" and click Settings next to it. You want to create a new certificate, type in a friendly name and press OK. You will need to set a username and password, use something other than "Administrator" as the username because it could be taken.
What this process does is modify your .csdef and .cscfg files. This is what will be added to the .csdef:
<Imports>
<Import moduleName="RemoteAccess" />
<Import moduleName="RemoteForwarder" />
</Imports>This is what will be added to the .cscfg file:
<ConfigurationSettings>
<Setting name="Microsoft.WindowsAzure.Plugins.RemoteAccess.Enabled" value="true" />
<Setting name="Microsoft.WindowsAzure.Plugins.RemoteAccess.AccountUsername" value="YOUR_USERNAME" />
<Setting name="Microsoft.WindowsAzure.Plugins.RemoteAccess.AccountEncryptedPassword" value="THE_ENCRYPTED_PASSWORD" />
<Setting name="Microsoft.WindowsAzure.Plugins.RemoteAccess.AccountExpiration" value="THE_EXPIRATION_DATE" />
<Setting name="Microsoft.WindowsAzure.Plugins.RemoteForwarder.Enabled" value="true" />
</ConfigurationSettings>Now, once those values are there, it means that the certificate was created with the information you wanted to use. You could publish through Visual Studio but that is a manual job each time. If you want to automate this, which you should, you need to get the certificate and add it to your Cloud Service during deployment.
To get the certificate, you need to go into your store. You need to run mmc.exe. After that launches, you need to add the Certificate snap in, choose Current user, go into your Personal\Certificates folder and then you will see the Remote Desktop connection certificate. You need to export it with the private key (as a .pfx file) by right clicking it.
Once exported, you can use it in PowerShell through the Azure cmdlets. What you want to do is specify the path to the file, the service you want to use the RDP cert with and the password you used for the .pfx file. Once you have all of that, you can easily automate adding the certificate to an existing Cloud Service. You get to be setup to make requests to your subscription before this will work.
# Classic Azure Service Management cmdlets (no longer usable after the 2024 retirement)
$rdpCert = Add-AzureCertificate `
-ServiceName $azureServiceName `
-CertToDeploy $serviceRDPCertPath `
-Password $rdpPfxCertPasswordUsing It
To connect with Remote Desktop, all you need to do is go into the Azure portal and go to your Worker Role for the Cloud Service. You will see a "Connect" button at the bottom, click that and it will download an RDP connection file. When prompted, enter the same username and password that you used at the beginning to set up the cert. From there, you will be logged into the running instance.
Warning!
If you have an existing deployment and you add these changes, it will break with the exception: "Windows Azure cannot perform a VIP swap between deployments that have a different number of endpoints". You can see some details about that here. In that case, it's best to completely delete the service or at least the one in production (if downtime can be tolerated). If downtime cannot be tolerated, you will need to route your traffic to a new service through DNS.
Additional Resources
Windows Azure certificate with thumbprint ... is missing
Define and Configure a Remote Desktop Connection
Using Remote Desktop with Windows Azure Roles
Frequently Asked Questions
Are Azure Cloud Services (classic) still available?
No. Cloud Services (classic) was retired on August 31, 2024. Cloud Services (extended support) is the Azure Resource Manager-based replacement and is itself scheduled for retirement on March 31, 2027.
How do I enable RDP on an Azure VM?
Windows VMs accept RDP on port 3389 by default. Allow it in the VM's network security group for your IP only, or use Azure Bastion so the VM needs no public RDP port, then use the portal's Connect button to download an RDP file.
What is the difference between Azure RDP and Azure Virtual Desktop?
RDP to a VM is administrator access to one server. Azure Virtual Desktop is a managed service that hosts Windows desktops and apps for many users, similar to Remote Desktop Services on-premises.
