Wrangles a VM such that you can connect to it, assuming no Public IP and an NSG blocking 3389.

ConnectToAzVm.ps1

# WRANGLE ResourceGroup
[CmdletBinding()]
param(
    $ResourceGroupName = 'ade-test'
)
<# Readd Public IP #>
$mgtNic = Get-AzNetworkInterface -ResourceGroupName $ResourceGroupName -Name *-nic

if (-not $mgtNic.IpConfigurations[0].PublicIpAddress.Id) {
    if (-not ($mgtPublicIp = Get-AzPublicIpAddress -ResourceGroupName $ResourceGroupName -Name 'tempip')) {
        $ResourceGroup = Get-AzResourceGroup -Name $ResourceGroupName
        $mgtPublicIp = New-AzPublicIpAddress -ResourceGroupName $ResourceGroupName -Name 'tempip' -Location $ResourceGroup.Location -AllocationMethod Dynamic
    }
    $mgtNic.IpConfigurations[0].PublicIpAddress = $mgtPublicIp
    $mgtNic = Set-AzNetworkInterface -NetworkInterface $mgtNic
}

<# NSG Rule #>
$NSGO = Get-AzNetworkSecurityGroup -ResourceGroupName $ResourceGroupName
$RDPRule = @{
    Name                     = "$($env:UserName)-RDP"
    Direction                = 'Inbound'
    Priority                 = (($NSGO.SecurityRules.Priority | Sort-Object)[0] - 1)
    Access                   = 'Allow'
    SourceAddressPrefix      = (Invoke-WebRequest -Uri "http://ifconfig.me/ip").Content
    SourcePortRange          = '*'
    DestinationAddressPrefix = '*'
    DestinationPortRange     = '3389'
    Protocol                 = 'TCP'
}
$null = Add-AzNetworkSecurityRuleConfig @RDPRule -NetworkSecurityGroup $NSGO
$null = Set-AzNetworkSecurityGroup -NetworkSecurityGroup $NSGO

$mgtPublicIpGet = Get-AzPublicIpAddress -ResourceGroupName $ResourceGroupName -Name $mgtNic.IpConfigurations.PublicIpAddress.Id.Split('/')[-1]

# Waiting for RDP to become available, as NSGs take a moment to update
do {
    try {
        $Success = [System.Net.Sockets.TCPClient]::new($mgtPublicIpGet.DnsSettings.Fqdn, 3389)
    } catch {Write-Verbose "RDP not active. Retrying."}
}
while (!$Success)

mstsc /v:$($mgtPublicIpGet.DnsSettings.Fqdn)