Big security risk in nested VM template.

It appears that the nested VM ARM template used in the deployment sets up the VM with a public IP address (red flag), then proceeds to set up an NSG which opens TCP port 3389 to the internet (double red flag with a splash of No-no added). I cannot find anything that explicitly states that a self-hosted IR needs a public IP. In fact, I'm pretty sure it doesn't... I can only assume this was done to make the VM accessible over the internet, but if you're working in an enterprise environment, you likely already have VPNs and/or Bastion/Jump hosts to resolve this issue. I'll be modifying this template to remove the public IP. Is this something you should consider also?

Start by locating the nested VM ARM template used for the deployment and review how its public IP and NSG rules are configured. Verify whether self-hosted IR requires either exposure, then update the template to avoid unnecessary public access and confirm the deployment remains valid without internet access to TCP 3389.

Written by the indexing model from the issue text.