Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community
Azure AD authentication to Windows VMs in Azure now in public preview
Published Dec 12 2019 09:00 AM 100K Views

Howdy folks, 

 

I’m excited to announce that Azure AD authentication to Windows Virtual Machines (VMs) in Azure is now available in public preview—giving you the ability to manage and control who can access a VM.

 

Deployment of Windows VMs in Azure is becoming very common and a challenge everyone faces is securely managing the accounts and credentials used to login to these VMs. Typically, people create local administrator accounts to login to these VMs and it becomes difficult to manage these accounts as people join or leave teams.

 

To make things simple people often follow the risky practice of sharing admin account passwords among big groups of people. This makes it very hard to protect your production Windows VMs and collaborate with your team when using shared Windows VMs.

 

Now, organizations can utilize Azure AD authentication over a Remote Desk Protocol (RDP) for their Azure VMs running Windows Server 2019 Datacenter edition or Windows 10 1809 and later.

 

Using Azure AD to authenticate to VMs provides the ability to centrally control and enforce policies using tools like Azure Role-Based Access Control (RBAC) and Azure AD Conditional Access to allow you to control who can access a VM.

 

There are many benefits of using Azure AD authentication to login to Windows VMs in Azure, including:

  • Utilizing the same federated or managed Azure AD credentials you normally use.
  • No longer having to manage local administrator accounts.
  • Using Azure RBAC to grant the appropriate access to VMs based on need and remove it when it is no longer needed.
  • Requiring AD Conditional Access to enforce additional requirements such as:
  • Multi-factor authentication (MFA)
  • Sign-in risk
  • Automating and scaling Azure AD join for Azure based Windows VMs.

 

You can use Azure Portal, AZ CLI, or PSH to enable this capability. Below is a quick example of how to do this from Azure Portal.

Using Azure Portal create VM experience to enable Azure AD login

You can enable Azure AD login for Windows Server 2019 Datacenter or Windows 10 1809 and later VM images.

To create a Windows Server 2019 Datacenter VM in Azure with Azure AD login:

  1. Sign in to the Azure portal, with an account that has access to create VMs, and select + Create a resource.
  2. In Search the Marketplace search bar, type Windows Server.
    • Click Windows Server and from Select a software plan drop-down, select Windows Server 2019 Datacenter.
    • Click Create.
  3. On the Management tab, under the Azure Active Directory, toggle Login with AAD credentials (Preview) to On.
  4. Make sure System assigned managed identity under the Identity section is set to On. This action should happen automatically once you enable Login with Azure AD credentials.

Go through the rest of the experience of creating a VM. During this preview, you’ll have to create an administrator username and password for the VM.

 

Azure AD authentication to Windows VMs 1.png

 

Using Azure AD portal experience to configure role assignment for the VM

To use your Azure AD credentials for Windows VMs in Azure, you must belong to Virtual Machine Administrator Login or Virtual Machine User Login role.

 

To configure role assignments for your Azure AD enabled Windows Server 2019 Datacenter or Windows 10 1809 and later VM images:

  1. Navigate to the specific Virtual Machine overview page.
  2. Select Access control (IAM) from the menu options
  3. Select Add, Add role assignment to open the Add role assignment pane.
  4. In the Role drop-down list, select a role such as Virtual Machine Administrator Login or Virtual Machine User Login.
  5. In the Select field, select a user, group, service principal, or managed identity. If you don't see the security principal in the list, you can type in the Select box to search the directory for display names, email addresses, and object identifiers.
  6. To assign the role, select Save.

After a few moments, the security principal is assigned the role at the selected scope.

 

Azure AD authentication to Windows VMs 2.png

 

You can check out our documentation to learn more about this feature and its prerequisites. Please let us know what you think in the comments below. We look forward to hearing from you!

 

Best regards,

 

Alex Simons (@Alex_A_Simons )

Corporate VP of Program Management

Microsoft Identity Division

48 Comments
Brass Contributor

Do the VM's actually get the status of beeing 'Azure AD joined' if you enable this? And does this mean that we can skip things like ADConnect and AADDS in the (near) future? Because the only reason to have that is to unify your logon identity and obtain SSO or do I misunderstand something?

Microsoft

Yes, these VMs do get Azure AD joined to your tenant. If you are user identities are on prem, you do need them to be synced to Azure AD using Azure AD Connect. Since these VMs are joined to your Azure AD tenant, you no longer need these VMs to join to Azure AD DS. 

Brass Contributor

Windows Virtual Desktop scenario support? PLEASE say yes (or soon) :)

Microsoft

We hope to enable this sometime next year (sooner than later).

Copper Contributor

Hi there,

 

Now that AAD Auth is available, does the VM required to be on AAD?

 

Thanks,

Allan

Copper Contributor

How does this impact RDP authentication at the protocol level? Is it still Network Level Authentication under the hood, or something new?

Microsoft

 

@chokigwapo When you enable this capability, the VM will be Azure AD joined to the same tenant where you are deploying the VM. This is currently only available for VMs deployed in Azure. We are looking to support this for non Azure VMs too sometime next year.

 

@Marc-Andre Moreau Nothing new, for RDP will still use NLA.

Copper Contributor

I am particularly interested in MFA enforcement for RDP. The section here (https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows) describes the client requirements, where a Windows 10 version 1809 RDP client is required with Windows Hello for Business or biometric authentication, in addition to being Azure AD joined to same directory as the target VM.

 

Are there plans to add support for a wider range of client use cases with MFA enabled? I am thinking something like a non domain-joined client and MFA with the Microsoft Authenticator app on a mobile phone. Bonus points for requiring a confirmation in Microsoft Authenticator for every RDP connection :)

Copper Contributor

Will this also become available for older Windows Server versions?

Microsoft

@Marc-Andre Moreau We want to support other credential types besides username/password or Windows Hello credentials. It will have to be in one of future Windows 10 releases. No ETA as of now.

 

@Jordy Blommaert We don’t plan to until there is significant demand to enable this for WS 2016. You can submit feedback on our forum https://feedback.azure.com/forums/169401-azure-active-directory

Copper Contributor
Copper Contributor

On which Azure Portal blade is the "Login with AAD Credentials" option found on an existing VM? 

In which data centers is the preview feature available?

Microsoft

@ms_dba The option is available on the Management tab during VM create. The capability is available in all data centers that map to our public cloud. For more information visit our documentation https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows

Deleted
Not applicable

Great feature! The next step would be enrolling machines under Windows Server in Microsoft Intune (sorry, Endpoint Manager in the cloud ^^) to apply them security baselines and configuration parameters. In a full-cloud strategy, we could use Auure built-in features for some basic config but customers want a unified management platform For client and servers and don’t want to deploy ConfigMgr for that

Copper Contributor

So can I make additional DC on premise from this VM, and what about the GP is this will still come from Windows Server or can I use Azure AD also for Group politics?

Brass Contributor

@Ahmedtameem, if you have a requirement for centralised policy-based management you will still need to AD join. If you decide to AD join, AADDS join, or promote the server to become a DC after deployment, this functionality would be superseded based on my understanding. 

Copper Contributor

This was a bit of a Bummer.... Client must be connected to same AAD....??? on RDP Connection error "Your credentials did not work".

 

Verify that the Windows 10 PC you are using to initiate the remote desktop connection is one that is either Azure AD joined, or hybrid Azure AD joined to the same Azure AD directory where your VM is joined to. For more information about device identity. (https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows )

 

 

 

Copper Contributor

Will this logon be available from Bastion and will the option to have a single sign on with bastion be enabled (like SQL DB AD authentication data explorer logon)

Copper Contributor

So, just for me to understand the RDP topic: I need another Win10 machine in the AAD structure so I can open an RDP session to server machines created the above mentioned way?!

 

My scenario: I'm in charge of sevaral customers Azure Tenants. Every tenant has a handful of Windows Server 2019 machines which have activated this feature. Does every tenant now needs an AAD joined Win10 machine so I can do my work?

Does this also affects machines that are later joined an AAD domain? This would "slightly" differ the way of work with several environments...

Microsoft

@Deleted Windows Servers do not have MDM stack so at present they cannot be managed by Endpoint Manager in the cloud. I would recommend taking a look at Azure Management Services - https://docs.microsoft.com/en-us/azure/governance/azure-management.

 

@Ahmedtameem@Kelvin Papp Once you enable this capability on an Azure IaaS Windows VM, then the VM is Azure AD joined. You cannot then promote it to a DC or join to any other AD or Azure AD DS domain. If you need policy management, I would recommend you to take a look at the different services offered by Azure Management Services - https://docs.microsoft.com/en-us/azure/governance/azure-management. Additionally, this capability does not supersede on a VM that is joined to AD/Azure AD DS. 

 

@Jasper Kraak We are working with Windows on this and it will take sometime to support other configurations and extend this to non Windows platforms too.

 

@bel_from_nz We are working with Azure Networking team to determine how to best integrate this capability with Azure BAstion Service. Expect more details on this sometime next year.

 

@airliner We have added support in the next release of Windows to allow an Azure AD Registered Windows 10 client to RDP to an Azure AD join target machine. This will allow you to add additional work or school accounts on you Windows 10 PC for each of the customer tenants you manage and then use the respective account to connect over RDP to your target Azure AD joined machine. You can verify this using any of our latest Windows 10 Insider Build https://insider.windows.com/en-us/.

Brass Contributor

Thanks @Sandeep Deo

 

To confirm, it’s not possible to deploy a VM with this option enabled, and subsequently change the configuration to support a traditional AD scenario?


I’m surprised by this. Do you not see a use case for managed authentication via Azure AD in advance of post deployment configuration for traditional domain join scenarios? Is this planned?

Copper Contributor

@Kelvin Papp: I wouldn't see this either. Maybe you could explain why you would switch your machines from an AAD join to a "traditional" AD join with hosted Domain Controller, etc.?! This would be an interesting scenario I think.

Copper Contributor

I created 2 windows 10 machines with azure ad joined feature enable or login with azure ad credential. My both machines are AD joined I can see under Azure Ad devices but when I try to login with azure ad credential after assigning rbac role... Getting 

"Your credentials did not work".

 

I am unable to understand what's missing... Both VM are win 10 latest and joined to AD as we can only RDP from AD joined VM so I loved in first windows 10 machine and trying to login with azure ad credential to the second VM still same issue 

"Your credentials did not work".

 

Please suggest.. 

 

Copper Contributor

Good post, great feature.

Brass Contributor

Looking forward to the update.  Just created an Azure VM and was disappointed that I couldn't use my Azure AD account to log in.  @airliner Any idea when the change above will go live?

Copper Contributor

@Stephen Palmstrom As far as I can see, the feature is already available (even in GA I think). I didn't try it any further because I need my machines in a more or less classical way in a domain service. So I have to use Azure AD DS (SharePoint is kinda old school in things like this).

It's a pretty **bleep**ty procedure to release your machine from Azure AD join and join it to the Azure AD DS. As of this FAQ (https://docs.microsoft.com/en-us/azure/active-directory/devices/faq#q-i-disabled-or-deleted-my-devic...) you may need to run "dsregcmd.exe /debug /leave" in cmd after you deleted a machine from the devices list in Azure AD. After that you're able to join the Azure AD DS like any other hosted domain with Domain Controllers, etc.

Copper Contributor

Is this only supported on the native Window 10 RDP app?

What do third party RDP app developers need to do e.g. https://mremoteng.org/ 

Copper Contributor

Is adding AD group (from on-premises AD, synced by AD Connect) to Virtual Machine Administrator Login is supported? Every example that I have found show only single Azure AD user.

Copper Contributor

I am still not able to log in. What I did differently is that I first logged in via Remote Desktop on the admin account and added the users there. Then later I followed the procedure described here. Any idea what might have gone wrong?  

Copper Contributor

Hi there, will this feature be enabled in at least Windows Server 2016 Datacenter?

Brass Contributor

As we know, the device from which we are kicking RDP-client to get into Windows VM  must be  AAD-joined or Hybrid-joined or AAD-Registered.

However, my understanding is there is NO  restrictions with respect to the account.

Meaning,  I can log in to the device with  user1@contoso.com  but when pulling up RDP-client I use  user2@contoso.com

 

If I am correct,  then if I have "Require multi-factor authentication"  as conditional-policy to get access into the VM ,  I must supply multi-factor authentication claim as part of the client that initiates the RDP session to the target Windows VM in Azure in form of  Windows Hello for Business PIN or biometric authentication.

My question is,  this biometric  is for  user2@contoso.com

It is NOT for user1@contoso.com  who has already signed into the device.

 

 

 

 

 

 

Copper Contributor

Great article. I found when I tried this it was missing a few things but I eventually got it to work. I'm in the middle of creating a Pluralsight course and I had to be logged into an Azure VM using Azure AAD. I did a quick video for my YT channel if you want to see a walk through of this.

What was missing was credssp in the RDP file and another command to add the user into the RDP users group since it can't be done by the GUI.

https://youtu.be/hbKNrNjQpUw

 

Copper Contributor

Hi I know MS doesn't like to comment on GA dates but are we still a long way off?

Copper Contributor

Hi,

can this be added retroactive to the creation of a VM? And +1 to the Bastion support.

Best

Martin

Copper Contributor

This looks great... I've configured this as indicated.
Unfortunately my whole organisation uses MAC OSx laptops... So we can't use this.

Why on earth does the client need to be in the same AD? 

Is there a solution so my organisation can use their O365 credentials to login a VM Windows 2019 system from their Mac OSx?

Brass Contributor

It is still not working for me.  I have been round various loops, but I still get authentication failures, even when making my AzureAD user a member of the local Remote Desktop Users group.  I have required MFA for that account as recommended by Azure!  I have once had 'The sign-in method you're trying to use isn't allowed. Try a different sign-in method or contact your systems administrator', otherwise authentication failures.  It is not helped by the clipboard not being enabled at login, so you can't paste a strong password into the password box.  I have, however, tried using the setting where it prompts you for a password before connecting, but that gave no joy either - once again an authentication failure.

I am running Windows 10 Pro 20H2 on the desktop I am using for RDP, so it is supposed to work.

 

 

Copper Contributor

Have you tried to prepend your username with `Azuread\` like e.g. `Azuread\my.name@example.com`? 

Copper Contributor

@daixtrose that’s it... !!!! AzureAd\ in front of the username did the trick for me... ! Thanks.

Copper Contributor

@daixtrose that’s it... !!!! Azuread\ in front of the username did the trick for me... ! Thanks.

Brass Contributor

Thanks, but been there, prepending AzureAD\name@domain didn't help.

Copper Contributor

@Stephen Palmstrom small letters ad : Azuread\ not AzureAD\ (unsure if that makes a difference)

Brass Contributor

Thanks, it makes no difference.  I don't think it is case sensitive. It may be related to MFA on the account.

Copper Contributor

@Stephen Palmstrom  i believe it is related to MFA:

"You need to ensure that the Windows 10 PC initiating the remote desktop connection to your VM signs in using a strong authentication method such as Windows Hello.

 

If you have not deployed Windows Hello for Business and if that is not an option for now, you can exclude MFA requirement by configuring Conditional Access policy that excludes "Azure Windows VM Sign-In" app from the list of cloud apps that require MFA."

 

You may refer to this link, the Troubleshoot sign-in issues section -https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows.

Brass Contributor

@VoonSengHong Thanks for your help.  I don't think AzureAD account authentication is an option looking at the information supplied.  I had seen the troubleshooting guide, and I think the authentication fails for the following reasons.

  1. Windows Hello is not available on my computer.  It is not 'owned' by the organisation, though it is registered with it.
     
     
     
     
     

    Screenshot 2021-01-25 161645.png

     

    I tried clicking to learn more, but although the system claimed to have fixed it, it did not.  I do sign in to the machine using a PIN.

     

  2. I looked at Conditional Access,  but that appears only to be available with Azure AD Premium. Other users will be in the same position.

    Screenshot 2021-01-25 162712.png

Hence, I think my colleagues and I shall have to stick to using local accounts on the VM. 

Brass Contributor

I've done further exploration:

 

  1. Having
    enablecredsspsupport:i:1
    in the connection file and attempting to pass credentials, i.e. user name and password gives fail authentication.
  2. Having
    enablecredsspsupport:i:0
    in the connection file and entering the user name prompts for a PIN, as I had clicked on the Windows Hello PIN option on my local PC and was asked to log in to the account (via MS Authenticator approval on a phone).  However, there is no option to set a PIN, so I still can't log on. It seems you need a PIN to log on, and need to be logged on to set a PIN - Catch-22.
  3. I tried using the MS Authenticator code generated on the phone, but that didn't work either. 

Where do I go from here?

Copper Contributor

Hi @Stephen Palmstrom, in my case, I configured the below and got it working:

 

1. Configure Conditional Access to exclude MFA requirement on Azure Windows VM sign-in:

 

VoonSengHong_0-1611661152596.png

 

2. Converted user from the built-in o365 MFA to Azure MFA:

https://albandrodsmemory.wordpress.com/2020/01/31/enabling-mfa-with-conditional-access/ 

 

3. Edit the RDP file, add the below lines:

enablecredsspsupport:i:0

authentication level:i:2

username:s:\AzureAD\user@contoso.com

 

Hope this helps!

 

 

Brass Contributor

@VoonSengHong Thank you for your help.  I am sorry to be a nuisance.

I could only find Conditional Access by searching for it, and New Policy is greyed out.  It seems I need Azure AD Premium to enable policies, or have I misunderstood something?

I disabled MFA on my account and logged in, only to be told that my account was configured not to allow me to log in to the machine.  That is despite my being a member of the Administrators and Remote Desktop Users group. I had hoped that logging in with a password would then let me set up login with a PIN.

 

Brass Contributor

We skipped domain services and we still wont want to use it. This could be the answer we were looking for but why does it have to Data Center edition??? Does this mean if we build our own vs using standard we are out of luck? 

Version history
Last update:
‎Jul 24 2020 01:27 AM
Updated by: