Enabled extension for AAD - not working

Question

Enabled extension for AAD - not working

Amogh Datar 20

We have enabled AAD Extension for existing Azure Windows Server VM and assigned role to relevant to user email id who needs to login to this vm but we he is unable to sign in using his azure id into the VM

Swaroop Kolli 5,285 Reputation points Microsoft External Staff Moderator

2025-07-31T06:39:13.4033333+00:00

Hello @Amogh Datar,

I understand that you have deployed AAD extension and assigned Virtual Machine user or Virtual Machine contributor role to a user who is trying to access the VM.
There are few more pre-requisites which are required to access the VM with Entra Credentials like excluding the VM sign in from CA policies, disabling per-user MFA and registering the physical machine with the same tenant where VM is hosted.

For a better understanding on this, I am sending you a private message with few details. Please revert back on a private message so that we can troubleshoot further.

Answer accepted by question author

0 additional answers

Your answer

Swaroop Kolli 5,285 Reputation points Microsoft External Staff Moderator

2025-07-31T06:39:13.4033333+00:00

Hello @Amogh Datar,

I understand that you have deployed AAD extension and assigned Virtual Machine user or Virtual Machine contributor role to a user who is trying to access the VM.
There are few more pre-requisites which are required to access the VM with Entra Credentials like excluding the VM sign in from CA policies, disabling per-user MFA and registering the physical machine with the same tenant where VM is hosted.

For a better understanding on this, I am sending you a private message with few details. Please revert back on a private message so that we can troubleshoot further.

Answer 1

Hello @Amogh Datar,

Thank you for your time over the call.

There are some pre-requisites for Entra user to login to Azure VM with Entra Credentials.

The VM must be Microsoft Entra joined, Entra hybrid joined, or Entra registered to the same directory as the client device.

The AADLoginForWindows extension must be installed. This is automatically added if you enable the "Login with AAD credentials" option during VM creation

The client machine must be running Windows 10 (20H1 or later) or Windows 11.

It must also be Microsoft Entra joined, hybrid joined, or registered to the same directory as the VM.

Per-user MFA should not be enforced for the user as this is a non-interactive sign in.

We had verified and found that device is not joined to Entra ID even after deploying the extension.

The AADLoginForWindows extension also requires a system-assigned managed identity to be enabled on the VM. If this is missing, the join process will silently fail. We had enabled system-assigned managed identity for the VM. This made the device join to Entra ID.

Now the user is able to login to VM with Entra ID credentials.

If the answer is helpful kindly accept it and if you have any further questions feel free to comment on it.