Can't RDP in an newly Azure-Joined Machine

Luis Olias 206

Hello,

I Azure-joined a machine (Windows 10 also in Azure, not OnPrem) successfully but I can't RDP with the Azure user with whom I joined it.

I can see the Device as "Azure Joined" in Entra ID, so that part appears to be correct.

I checked that the user belong to the computer's Local Admins. It does.

I tried to log in (RDP) with AzureAD\User1 and with UPN ( user1@mydomain.onmicrosoft.com ) but the error message says my credentials are not valid.

I can RDP with the user I indicated when creating the VM in Azure Portal, so I rule out any Firewall or Connectivity issues.

Thus I changed also the password because I thought I just wasn't remembering the password correctly.

Could it be the fact that the computer is OnCloud and not OnPrem?

Should the Cloud User belong to a specific role? because mine is a plain user, no roles attached or groups.

Is this a expected behaviour? That a plain user cannot RDP into an Azure-joined machine if that user belongs to the machine's Local Admin group? .

1 answer

Silvia Wibowo 4,006 Reputation points Microsoft Employee

2024-11-19T04:16:25.0333333+00:00
Hi @Luis Olias , I understand you've created an Azure VM as Azure-joined but you can't RDP using Entra ID credential.

Please note that to use Entra ID credential to login to Azure-joined VM, you need to:

Enable the Microsoft Entra login option for the VM.

Configure Azure role assignments for users who are authorized to sign in to the VM.

Please check the OS version, network, and authentication requirements: Sign in to a Windows virtual machine in Azure by using Microsoft Entra ID

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.
Please sign in to rate this answer.
Luis Olias 206 Reputation points

2024-11-19T07:17:24.2766667+00:00

Thanks Silvia,

What I have done and checked in the VM, from your kind reply:

Extension installed: AADLoginForWindows

IAM : Virtual Machine User Login ( and also Virtual Machine Administrator Login, just in case)

dsregcmd /status --- Azure AD Joined.

I restarted twice the machine because on the first restart it wasn't working. So I waited for a few minutes, restarted again and nothing doing unfortunately.

From RDP, I tried "AzureAD\user1@mydomain.onmicrosoft.com" and only with the UPN without "AzureAD" .

"User1" is a Cloud User with no special groups or roles (besides the aforementioned)

I check the Machine Event Viewer but didn't see anything that I could think as an issue, probably my fault here.

But really my point is: Are the 3 steps that I mentioned above the first troubleshooting steps logical?

I think it is not a Firewall issue because I created the VM with a specific user in the Azure Portal and with this user I perfectly can RDP.

Thanks a lot for your time! -- -- -- -- -- EDITION: From the article you mentioned above (https://learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-windows ) it is said that the user cannot have a temporary password, which was my case and I didn't notice. So I logged into Azure Portal and changed the password because it was required. After I changed it I was hoping the issue would be solved but it didn't work.

Also, in "dsregcmd /status" , the "AzureADJoined" is "Yes" but the value for "AzureAdPrt" is "No" and the article says it must be "Yes" . "AzureAdPrt" is PRT = Primary Refresh Token (SSO) , but it is set to "No" in my case.

Anyway, this is being fun and very informative to get my Azure Certificate soon hopefully. Fun troubleshooting.

Thanks.

Lijitha B 505 Reputation points Microsoft Vendor

2024-11-19T11:32:39.0366667+00:00

Hi Luis Olias,

Thank you for the detailed steps you’ve performed. Here are some additional suggestions to check and validate:

Run this command on the VM to add the user to the Remote Desktop Users group:

net localgroup "Remote Desktop Users" /add "AzureAD\user1"

Please check NLA is properly configured by opening Local Group Policy Editor (gpedit.msc) and navigating to Computer Configuration > Administrative Templates > System > Credentials Delegation.

Enable Allow delegating saved credentials with NTLM-only server authentication and add TERMSRV/* to the list.

Go to Azure Portal > VM > Extensions + Applications and ensure AADLoginForWindows is in a Healthy state. Reinstall if necessary.

Check Applications and Services Logs > Microsoft > Windows > TerminalServices-LocalSessionManager > Operational in Event Viewer for any login-related errors.

If needed, remove and rejoin the VM to Azure AD.
Please refer the below documentation:

Sign in to azure VM using Entra ID

If you have any further queries, do let us know.

Silvia Wibowo 4,006 Reputation points Microsoft Employee

2024-11-19T22:05:07.8933333+00:00

Hi @Luis Olias , please follow these steps: Troubleshoot primary refresh token issues on Windows devices.

Another item to check: If your organization has configured and is using Microsoft Entra Conditional Access, your device must satisfy the conditional access requirements to allow connection to the remote computer. Conditional Access policies with grant controls and session controls may be applied to the application Microsoft Remote Desktop (a4a365df-50f1-4397-bc59-1a1564b8bb9c) for controlled access.

Silvia Wibowo 4,006 Reputation points Microsoft Employee

2024-11-19T22:08:51.9133333+00:00

Hi @Lijitha B ,

Please refer to this note from Configure role assignments for the VM:

Manually elevating a user to become a local administrator on the VM by adding the user to a member of the local administrators group or by running net localgroup administrators /add "AzureAD\UserUpn" command is not supported. You need to use Azure roles above to authorize VM login.

Luis Olias 206 Reputation points

2024-11-20T12:47:25.19+00:00

Many thanks for all your comments.

I have tried everything repeatedly. I probably missed something but not able to catch it.

I'm out of options now. Probably if I go over all this again in a few days, my mind will be clearer and fresher.

I apologize if I have to provide an answer but right now I just can't say what is going on here really.

Many thanks!

Luis Olias 206 Reputation points

2024-11-20T17:48:24.1533333+00:00

I am trying the whole thing in a different Tenant.

Same issue.

I have some questions just to see if I am getting this right:

When I give the role (RBAC) "Virtual Machine User Login" in IAM in the Virtual Machine, does that not give the user the right to log into the machine through RDP?

Equally, if I give the role "Virtual Machine Administrator Login" , does that not put the user into the local "Administrators" group of the VM?

I have included the user in the "Remote Desktop Users" (local to the VM) and the RBAC role IAM "Virtual Machine User Login" . The thing is that when I go to that "Remote Desktop Users" I see the SID beside, like "S-1-12-1-15......130" , which makes me think there might be some issue when connecting to Azure AD? . Because if I go to the "Administrators" group of the VM, apart from "Administrator", I see two other users but not their names but their SIDs ( S-1-12-1-1583644432.... ) which again makes think of connectivity issues with Azure AD?

I have been able to add the Cloud User to the "Remote Desktop Users" local to the VM, through Powershell ( Add-LocalGroupMember... ) but not through the GUI because in the GUI, in the "location" part when adding users, the only location available is the local machine and not Azure AD users to add from.

I also saw a Script to help troubleshoot connectivity issue but the outcome looks fine:

In Event viewer I see this:

Http request status: 400. Method: GET Endpoint Uri: https://login.microsoftonline.com/d890e79e-afd2-4fd5-84bf-f5f796732b32/sidtoname Correlation ID: 22D5C2EF-0117-4A82-92AC-FE1B31609141

I am looking into this issue in Event viewer.

Thanks in advance.

Lijitha B 505 Reputation points Microsoft Vendor

2024-11-22T16:18:00.2266667+00:00

Hi Luis Olias,

Thanks for replying back to us. We are looking into it and will get back to you soon.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Can't RDP in an newly Azure-Joined Machine

1 answer

Your answer