Unable to Login to Server Via RDP After Enabling Network Level Authentication

Question

Hello Azure team,
I attempted to prevent man-in-the-middle-attack by enabling network level authentication in my server (more like a bastion host). This server is accessible via Microsoft Remote Desktop on MacBook. My accounts and those of my colleagues are on Azure AD. So this is AD joined accounts (azureAD\username@example.com plus password on RDP). The moment this is enabled, logins were disabled with error:

We couldn't connect to the remote PC because your credentials did not work. The remote machine is AAD joined. If you are using your work account you must disable Network Level Authentication on the remote machine. If you are using a local account, verify your username and password.

Error code: 0x3107

Our staff are on Azure AD. How can I enable NLA and still allow staff access this server via microsoft remote desktop with their work email account?

Thank you!

Answer 1

Hello,

This design does not permit it. If you enable Network Level Authentication (NLA), your client needs to pass your credentials to Azure Active Directory (AAD). Disabling NLA means that your endpoint would handle the credential passing instead. So, the issue might be that your client cannot transmit your credentials to AAD. You might want to try joining your client to AAD to see if that resolves the issue.

---

If the Answer is helpful, please click "Accept Answer" and upvote it.