Troubleshooting VM Connectivity Issues
VM connectivity failures split into boot/agent problems, network problems, and guest OS problems. Know the Azure serial console, boot diagnostics (screenshot and serial log), the VM agent and extensions, and Run Command. Just-in-time access and Azure Bastion change how you connect; Bastion requires the AzureBastionSubnet with a specific name and size.
Traps: RDP or SSH failing while the VM is Running often means NSG rules, a missing public IP, or the guest firewall. If the VM is unreachable but boot diagnostics show it started, suspect the guest OS firewall, a broken NIC configuration, or a custom route. If boot diagnostics show a boot failure, use serial console or repair/redeploy. Accelerated networking, multiple NICs, and custom DNS settings can cause asymmetric or failed name resolution. Also remember that changing an NSG does not fix a guest-level firewall, and that a VM's public IP may be Basic (no zone redundancy, no secure defaults) versus Standard.
Worked example: an SSH connection times out although the VM is Running and boot diagnostics look healthy. Check the effective NSG rules on the NIC for port 22, confirm a public IP or Bastion path exists, then use Run Command to verify sshd status and the guest firewall. If the NSG denies 22, add the rule; if the guest firewall blocks it, fix inside the OS.
Use Boot diagnostics and serial console for OS-level faults, Network Watcher for path faults, and the Activity Log for platform operations such as restarts or redeployments.