According to the official documentation for Administering Windows Server Hybrid Core Infrastructure , using Windows Admin Center (WAC) within the Azure portal to manage virtual machines requires specific network pathing depending on the IP configuration of the target VM. For a virtual machine like VM1 that is configured with only a private IP address , the management traffic originat es from the browser on the administrator ' s local computer and must be able to reach that private IP address directly.

The primary requirement for this scenario is that the management PC must have access to the virtual network (VNet) that is connected to th e VM. As specified in the study guides, when managing a VM via its private IP, you must establish a hybrid connectivity solution such as a VPN connection (either Point-to-Site or Site-to-Site) or Azure ExpressRoute . This bridge allows the on-premises Windo ws 11 computer to route traffic into the Azure Virtual Network ' s private address space. Without this underlying network connectivity, the browser-based WAC gateway—which is hosted as an extension on the VM—cannot communicate with the portal interface.

Whil e Azure Bastion (Option A) provides secure RDP and SSH access, the Windows Admin Center extension specifically requires network-level routing from the client to the private IP for its portal-integrated management features. Network Security Group (NSG) rule s (Option C) are necessary to allow traffic on specific ports (like 443 for the WAC service), but they do not provide the routing necessary to cross the boundary between an on-premises network and an Azure VNet. Similarly, Private Endpoints (Option D) are intended for accessing Azure PaaS services rather than providing a management path for IaaS VMs. Therefore, configuring a VPN connection is the verified mandatory step to satisfy the connectivity requirements for WAC in this hybrid context.