Explanation:

References:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-resource-roles- assign-roles

Check below steps in explanation for Task.
Explanation
To configure Azure to allow RDP connections from the Internet to a virtual machine named VM1, you can follow the steps below:
Create a new inbound security rule in the network security group (NSG) that is associated with the virtual network subnet that contains VM1. The rule should allow RDP traffic from the Internet to the virtual network subnet. You can use the Azure portal, Azure PowerShell, or Azure CLI to create the rule.
Configure the network security group (NSG) to associate it with the virtual network subnet that contains VM1.
Configure the virtual machine to allow RDP traffic. You can use the Azure portal, Azure PowerShell, or Azure CLI to configure the virtual machine.
To minimize the attack surface of VM1, you can use the following best practices:
Use a strong password for the local administrator account on the virtual machine.
Use Network Security Groups (NSGs) to restrict traffic to only the necessary ports and protocols.
Use Azure Security Center to monitor and protect your virtual machines.