Azure DevOps. Unable to Do PSRemoting from Self-Hosted Agent

PowerShellOnTargetMachines@3 task throws access is denied error when running on self-hosted agent, but doesn't throw that error when running on Microsoft-hosted agent. This YAML works:

trigger: none

pool:
  vmImage: 'windows-2019'

steps:
- checkout: none

- task: PowerShellOnTargetMachines@3
  displayName: 'PowerShell on Target VM'
  inputs:
    Machines: '$(VM-PublicIP)'
    UserName: '$(VM-UserName)'
    UserPassword: '$(VM-Password)'
    InlineScript: |
      Write-Host Hello-World

However when changing:

vmImage: 'windows-2019'

to:

name: 'DevOps-Agent2-VM'

the task fails with access is denied error.

This YAML doesn't work:

trigger: none

pool:
  name: 'DevOps-Agent2-VM'

steps:
- checkout: none

- task: PowerShellOnTargetMachines@3
  displayName: 'PowerShell on Target VM'
  inputs:
    Machines: '$(VM-PublicIP)'
    UserName: '$(VM-UserName)'
    UserPassword: '$(VM-Password)'
    InlineScript: |
      Write-Host Hello World

Error logs:

Starting: PowerShell on Target VM
==============================================================================
Task         : PowerShell on target machines
Description  : Execute PowerShell scripts on remote machines using PSSession and Invoke-Command for remoting
Version      : 3.200.0
Author       : Microsoft Corporation
Help         : https://docs.microsoft.com/azure/devops/pipelines/tasks/deploy/powershell-on-target-machines
==============================================================================
##[error]Unable to create pssession. Error: 'Connecting to remote server [REDACTED IP] failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic.'
##[error]PSSession could not be created for Machine:'[REDACTED IP]:5986'
Finishing: PowerShell on Target VM

What could be the reason for such behaviour?

Update1: I'm able to connect to the target VM from the self-hosted agent by running these commands:

$hostName = '[IP]'
$admin = "[Username]"
$password = "[Password]"

# Convert Password
$securePassword = ConvertTo-SecureString $password -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential($admin, $securePassword)
# Connect to the machine
$soptions = New-PSSessionOption -SkipCACheck
Enter-PSSession -ComputerName $hostName -Port 5986 -Credential $cred -SessionOption $soptions -UseSSL

And I had configured WinRM on the target computer by running these commands:

New-Item -Path WSMan:\LocalHost\Listener -Transport HTTPS -Address * -CertificateThumbPrint $Cert.Thumbprint
New-NetFirewallRule -DisplayName 'WinRM HTTPS-In' -Name 'WinRM HTTPS-In' -Profile Any -LocalPort 5986 -Protocol TCP

Update2: I’ve recreated everything from the scratch and getting the same results. Here are the steps to reproduce:

1. Create Windows Server 2022 Datacenter: Azure Edition VM (target VM) on Azure.
2. Set up WinRM on that VM via the following PowerShell script:

$IP = Invoke-RestMethod http://ipinfo.io/json | Select -exp ip
$VM_Primary_IP = $IP
Write-Host IP of the computer is $VM_Primary_IP
Enable-PSRemoting
 
$Cert = New-SelfSignedCertificate -CertstoreLocation Cert:\LocalMachine\My -DnsName $VM_Primary_IP
Export-Certificate -Cert $Cert -FilePath "C:\PSRemotingCertificate-$IP.cer" -Force
 
New-Item -Path WSMan:\LocalHost\Listener -Transport HTTPS -Address * -CertificateThumbPrint $Cert.Thumbprint
New-NetFirewallRule -DisplayName 'WinRM HTTPS-In' -Name 'WinRM HTTPS-In' -Profile Any -LocalPort 5986 -Protocol TCP

3. Create another Windows Server 2022 Datacenter: Azure Edition VM (source VM or Self-Hosted Agent VM) on Azure.
4. Make sure that the source VM (Self-Hosted Agent VM) is able to connect to the target VM by executing the following PowerShell script:

$hostName = '[IP]'
$admin = "[Username]"
$password = "[Password]"

# Convert Password
$securePassword = ConvertTo-SecureString $password -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential($admin, $securePassword)
# Connect to the machine
$soptions = New-PSSessionOption -SkipCACheck
New-PSSession -ComputerName $hostName -Port 5986 -Credential $cred -SessionOption $soptions -UseSSL

5. Set up Azure DevOps Self-Hosted Agent on the second VM, by executing the following commands in PowerShell:

mkdir C:\agent
Invoke-WebRequest -Uri https://vstsagentpackage.azureedge.net/agent/2.210.1/vsts-agent-win-x64-2.210.1.zip -OutFile C:\agent\vsts-agent-win-x64-2.210.1.zip
Expand-Archive -LiteralPath 'C:\agent\vsts-agent-win-x64-2.210.1.zip' -DestinationPath C:\agent

Then setting up the Self-Hosted Agent via CMD:

Cd C:\agent
config.cmd

6. Create an Azure DevOps YAML Pipeline where Self-Hosted Agent VM will try to execute a PowerShell command on target VM (replace Debug1-Pool and fill the following variables with your values: $(VM-PublicIP), $(VM-UserName, $(VM-Password)):

trigger: none

pool:
  name: 'Debug1-Pool'
steps:
- checkout: none

- task: PowerShellOnTargetMachines@3
  timeoutInMinutes: 5760
  displayName: 'PowerShell on Target VM'
  inputs:
    Machines: '$(VM-PublicIP)'
    UserName: '$(VM-UserName)'
    UserPassword: '$(VM-Password)'
    newPsSessionOptionArguments: '-SkipCACheck'
    InlineScript: |
        Write-Host Hello world

7. Get access is denied error.