You are designing a multi-tiered application that will be hosted on Azure virtual machines. The virtual machines will run Windows Server. Front-end servers will be accessible from the Internet over…

While Azure Bastion provides secure RDP/SSH access to VMs without exposing the VMs' public IPs, the Bastion host itself still requires a public IP address for its control plane, which represents a point of internet exposure.

Service Endpoints provide secure and direct connectivity from a VNet to Azure PaaS services, keeping traffic on the Azure backbone, but they do not facilitate RDP access to virtual machines.

Azure Private Link allows administrators to establish a private, secure connection to management services or jumpboxes within the Azure virtual network, from their on-premises network via VPN/ExpressRoute or another Azure VNet. This ensures RDP traffic never traverses the public internet, dramatically minimizing the virtual machines' exposure and adhering to strict security requirements.

Azure Front Door is a global, scalable entry-point that uses the Microsoft global edge network to create fast, secure, and highly scalable web applications, but it does not provide RDP access to virtual machines.