RDP access can be configured on either the network security group or in the network security group rule.
RDP access should not be permitted from the internet (*, 0.0.0.0, /0, internet, any). Consider using the Azure Bastion Service.
Anyone from the internet can potentially RDP onto an instance
Block RDP port from internet
The following example will fail the azure-network-disable-rdp-from-internet check.
The following example will pass the azure-network-disable-rdp-from-internet check.