Forum Discussion
Entra ID logins to Azure VMs.
Hello everyone. I've posted a much longer, more detailed question about this on the Azure support forums, but I'm trying to get more people to look at this.
Basically, I'm trying to set up Entra accounts that can log into an Azure-based Windows VM, using the instructions Microsoft have put here:
https://learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-windows
I've treated the Microsoft instructions as a checklist, in order to be as precise as possible. My own notes and records from 2024 seem to indicate I built a similar system then, following the same instructions. I was surprised that it didn't work as easily this time.
Does anyone know of changes that were made to Entra ID since 2024 (or 9 months ago, when most of the newest YouTube tutorials were made) to make it much harder to use? In addition to Microsoft's instructions, I have also experimented with alternative configurations (a lot of them) detailed on YouTube, none of which worked.
My VM (and Entra itself) both seem to indicate that my Entra accounts are valid, and that the VMs are correctly joined to Entra. I am still able to log into the VMs with local accounts, so the VMs are correctly connected to Azure. I've tried both with and without a Bastion, with the same results. Local accounts work, but Entra doesn't.
I've so far been unable to log the Entra accounts in at all, as the passwords (all of them valid, and double-checked) have been rejected. I think if I could find one method of using the Entra accounts which worked, I would settle on it, but so far I haven't found a single configuration that works.
Does anyone have a theory of what's blocking me? I do have more test data, but I don't want to flood this post. Thanks.
8 Replies
Hi jsk1 , try this as it worked too.
Run-- MSTSC--Show Options--Advanced-- user authentication -- Tick ( use a web account to signin to the remote computer). If your VM is Entra ID joined then you should be able to use this option and login via web account method. It will ask you to approve your login via MFA also.I have tried that. I think someone else also recommended it, but it has no effect.
Yes, this has changed since 2024. The major ones are stricter requirements for RBAC role assignments, mandatory use of the “AADLoginForWindows” VM extension, and expanded enforcement of Conditional Access/MFA policies, learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-windows
Step which fixed my issue:-
Navigate to the overview page of the virtual machine. Select Connect to open the Connect to virtual machine blade. Click Download RDP File. Right Click on RDP file and Open with Notepad. Add or Append the below two lines:-
enablecredsspsupport:i:0
authentication level:i:2Final RDP File should look like this
After that use AzureAD\email address removed for privacy reasons
It should work!!
When I change those settings in the RDP file, it gets me as far as the login screen (which I've managed to do many times before). The credentials are then rejected. I have reset the password, and restarted the VM, but this has no effect. This problem is still unresolved, and I am starting to believe that Entra simply no longer has this functionality, if it ever did. I do want to know for sure, though. Does anyone know if it is still possible to log into VM's using an Entra ID?
I'm sorry, I missed your reply earlier. Long story short....I've already assigned my test user the Virtual Machine Administrator Login role, and I've tried these formats for the username:
(username alone)
(username)@(domain)
AzureAD\(username)@(domain)
AzureAD\(username)None of those worked. I'm assuming that conditional access isn't interfering with the login, since my subscription doesn't include it anyway (it's just Pay-As-You-Go).
Still, is there any remote access role, for example, that needs to be activated? Someone else suggested that, but they appeared to have more features (meaning more choices) on their subscription. For comparison:
Their account:
My account:
Do you think there's anything I COULD do to unlock RDP, if that's really my problem? RDP does work for the local account. Thanks.Hi, I’d start by checking the sign-in format and RBAC side first. For Entra login to an Azure Windows VM, the user normally needs the right Azure role assignment, such as Virtual Machine User Login or Virtual Machine Administrator Login, scoped to the VM or resource group. Also make sure you are signing in with AzureAD\email address removed for privacy reasons or the expected Entra format, not just the short username. If local accounts work but Entra accounts are rejected, it often points to RBAC, device join state, Conditional Access, or the VM login extension rather than the password itself.
This has also been done. I have attempted both the Virtual Machine Administrator login, and the Virtual Machine User login, in line with Microsoft's instructions, and they have no effect. I have also tried three different accounts on Entra ID, with these different role assignments via Access Control (IAM)>Role Assignments>Add, and none of them work.
