Azure VM Hybrid AD Joined and RDP with FIDO2

Question

Hey guys,

I installed a new VM on Azure, enabling the AAD Login Extension functionality.

It then assigns RBAC permissions, according to Microsoft documentation, to the machine local user.

It happens that when I try to add user that I want RDP to as a member of the Remote Desktop Group, it generates the following error:

"Principal XXX was not found"

when i try it with net localgroup "Remote Desktop Users" /add "XXX" i get: There is no such global user or group.

Is it possible to actually use an AzureAD user to authenticate through RDP Azure VM OnPrem domain, but with the AAD Login extension activated? Thanks for your help! Regards.

Answer

Hi @Jorge Freitas

Thank you for reaching out to the community forum!

The error message "Principal XXX was not found" indicates that the user or group being added to the Remote Desktop Users group does not exist in the Azure AD tenant or a syntax error in the command could you please check if the user is exists in the tenant.

net localgroup "Remote Desktop Users" /add "AzureAD	est@contoso.com"

Replace test@contoso.com with the users UPN or the object ID. may I know the VM is being AAD joined?

Also, if possible, try adding a different user to the Remote Desktop Users group to see if the issue is specific to the user account or for every user.
If the error persists, check the Event Viewer for any relevant error messages that might provide additional information about the problem.

The other side to answer your question. Yes, it is possible to use an Azure Active Directory (AAD) user to authenticate through Remote Desktop Protocol (RDP) to an Azure Virtual Machine (VM) that has the AAD Login extension activated. This setup allows you to leverage Azure’s cloud-based identity service for authentication, even if the VM is not part of an on-premises domain.