Azure VNET: Where is the VM RDP access through port 3389 rule is defined?

Greetings,

Using Resource Manager model:

When I create an Azure VM, access to the RDP port to the public internet is enabled by default. There is no Network Security Group is assigned to the VM.

I am trying to understand where and how is the RDP port 3389 access rule is defined?

Thank you,