Administrators need a supported private VM management path while session hosts should not expose public RDP. Which service can be evaluated?

1. Publish an administrator password in the workspace description
2. Use a profile container as a remote administration gateway
3. Open RDP from the entire internet
4. Azure Bastion with appropriate access controls