Is RDP enabled, and if so, accessible internally only or externally?
Internet-facing remote desktop is close to an automatic decline in this market. It is also something the carrier can check from outside before quoting.
What the carrier is actually asking
The carrier is asking whether remote desktop is in use and, critically, whether it is reachable from the public internet. Internal use with brokered access is ordinary; direct exposure is not.
Why it is underwritten
Exposed remote desktop has been among the top ransomware initial access vectors for years. Credentials are brute-forced or bought, and the service offers full interactive access on success. Carriers scan for it, several decline on finding it, and almost all price it heavily.
Where the answer lives in Microsoft 365, Entra ID, and Azure
In Azure this is directly measurable, and external verification is straightforward for anyone including the underwriter.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Azure | Network security group rules allowing port 3389 from any source | No rule permitting RDP from the internet, at any scope |
| Azure | Just-in-time virtual machine access configuration | Management ports closed by default and opened on request for a limited window |
| Azure | Azure Bastion deployment | Brokered access without exposing the port, which is the strong version of this answer |
| Azure | Public IP addresses assigned to virtual machines | Machines without public addresses cannot be reached directly regardless of rules |
| External | An internet scan of your address ranges | Nothing responding on 3389. This is the check the carrier can run themselves |
Exposure is usually accidental: a temporary rule for a migration, a machine built outside the standard process, a rule at a different scope than the one you reviewed. Scan your own ranges before answering rather than answering from the intended design.
What a defensible yes requires
- No management port is reachable from the internet, verified by scanning rather than by policy.
- Where remote desktop is used internally, access is brokered through a bastion or jump host.
- Just-in-time access closes ports by default.
- Virtual machines do not carry public addresses unless they must.
- A recurring check detects new exposure, since it usually arrives by accident.
How this answer goes wrong
The answer is internal only, and a scan finds one machine with an inherited rule from a project two years ago. The rule was temporary, nobody removed it, and it is the single most valuable finding an attacker could make about your estate.
Frequently asked
Is RDP over VPN acceptable?
Yes, and it is the common design. The question is about direct exposure, so a VPN-gated path with multi-factor is a clean answer.
What about a remote desktop gateway?
Better than direct exposure and still an internet-facing service. It needs multi-factor, current patching, and monitoring, and it should be named on the form rather than omitted.
Does a non-standard port help?
No. Internet-wide scanning finds services on any port within hours. It provides no protection and it removes your own visibility.
How do we check?
Scan your public ranges from outside, or use your cloud provider exposure reporting. Both take minutes and settle the question definitively.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture