Use "az vm repair" extension to create repair VM with private IP only
A few months ago, I recommended az vm repair to help create a rescue vm. When running az vm repair create from the subscription, the operation fails because they had a policy to block Public IP addresses.
I propose an optional switch that gives the option to not give the repair VM a Public IP and to specify the pre-existing VNET you'd like to create the Repair VM on.
This way, the operation will complete on such a subscription and the VM will have a Private IP. Then depending on the user's setup (VPN, using another VM as a jump box, etc), they can still access the Repair VM via the private IP.