1) Make sure that Network Security Groups (NSGs) allow inbound traffic from your VPN's client address pool (the IP Address that the RDP connection will be coming from). NSGs will sit on the NIC of the VM, or on the Subnet that the VM is in. the 'Networking' tab of the VM will show you active NSGs and their rules.
If that doesn't work, make sure that the remote computer is accepting RDP connections.
If RDP is working over Public IP, then your VM is definitely receiving RDP connections.
I would look at your NSG to make sure that port 3389 is open, and allowing connections from all addresses, or from your VPN's client address pool.
The rule needs to be an inbound rule, and preferably higher priority than other rules.