Cannot connect to Azure Virtual Desktop using Point-to-Site from macOS RDP Client

Arman Koradia 0

I have the following scenario:
I have setup Point-to-Site connectivity for my Virtual Network. I have provisioned Azure Virtual Desktop Host Pool in which the VMs are deployed on the VNet which has P2S configured.

P2S is configured to use Azure AD for authentication and it is working fine. I am able to connect successfully.

VMs in HostPool are Entra Joined VMs. The RDP Properties of the HostPool has "Enable Microsoft Entra authentication for RDP" is selected.

Private Endpoints setup for HostPool and Workspaces are completed and private endpoints are created for connection, feed and global. AVD VM in HostPool stays in "Can Connect".

Now when I am connected to VPN and I try to connect to VM by adding workspace from RDP Client installed on macOS, I get the following error message: "Unable to access resources from your network". I get the same error in web client from browser.

However, from RDP client, if I try to connect to VM by adding the Private IP address, I am able to connect successfully. But I have to login to VM using the Local Admin credentials.

I am unable to login to VM using my Azure AD/Entra ID credentials. When I use my Entra ID credentials, it says "Username or password incorrect".

Please help on how I can fix the two issues mentioned above.

anashetty 255 Reputation points Microsoft Vendor

2024-09-09T16:54:00.9866667+00:00

Hi Arman Koradia,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

For the Error "Unable to access resources from your network"

Verify that Azure AD authentication is properly set up for the AVD Host Pool. On your macOS device, run nslookup <private-endpoint> to ensure the private IP is resolving correctly. Also, check for any firewall rules that might be blocking traffic between your VPN client and the AVD Host Pool, and confirm that the required RDP ports are open.

For the error "Username or password incorrect"

Ensure the VM is properly joined to Azure AD by checking the Azure portal to confirm it appears as an Azure AD-joined device. Additionally, verify that Microsoft Entra authentication for RDP is enabled in your AVD Host Pool by reviewing the RDP properties in the Host Pool settings within the Azure portal.For more information, please refer to this document
https://learn.microsoft.com/en-us/azure/virtual-desktop/troubleshoot-client-macos

If you have any further queries, please do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it."
Arman Koradia 0 Reputation points

2024-09-10T04:20:52.6466667+00:00

Let me try to answer your questions one-by-one:

Azure AD authentication is setup correctly in AVD Host Pool settings. RDP Properties has Microsoft Entra ID single sign-on has value set to "Connections will use Microsoft Entra authentication to provide single sign-on"

I tried nslookup for one of the DNS record present in Private Link DNS Zone but I think it is not using the Azure-provided DNS server since it didn't resolve. It is using my system default gateway.

However, I am able to connect to VM present in AVD Host Pool using the Private IP. So I am really confused here on what is going on.

VPN Diagnostics gives green tick for everything i.e. Client Creds, Server Resolvable, Server Reachable etc.

VM is properly joined to Azure Entra ID and I can see that under devices list. Join type is "Microsoft Entra Joined".

Regarding Firewall rules, I have not set any explicit Azure Firewall or NSG except one NSG that I have associated with AVD HostPool subnet which has the VMs. The rules in that NSG blocks the internet outbound and allows 3389 and 443 from the Address Pool I have given in my P2S configuration.

P.S: The username and password incorrect when using Entra ID credentials worked when I disabled NLA from System Properties i.e. System Properties > Remote > Allow Remote Connections to this Computer > Uncheck "Allow connections only from computer running RDP with NLA"
If I keep this property on, I won't be able to connect to VM at all. I get an error in the RDP client itself.

Please share additional inputs if any. If there is a config miss, let me know.
anashetty 255 Reputation points Microsoft Vendor

2024-09-10T17:04:32.4133333+00:00

Hi Arman Koradia,

Thanks for getting back with the detailed explanation. We are looking into it and will get back to you soon.

Thank you.
anashetty 255 Reputation points Microsoft Vendor

2024-09-11T15:03:07.0733333+00:00

Hi Arman Koradia,

Thanks for getting back with the detailed explanation. Based on the error details you shared, I have shared troubleshooting steps that I felt will help resolve the issue you reported.Check the RDP settings on the VM and ensure that they're correctly configured to allow connections from the Address Pool specified in your P2S configuration.

As it is using your system default gateway, ensure that your Point-to-Site VPN configuration is correctly set up to use Azure DNS. This can be done by configuring the correct DNS servers in the VPN client configuration: For Azure DNS integration, manually set 168.63.129.16 as the DNS server in the VPN client configuration.

If DNS resolution isn't happening, check if outbound rules to Azure DNS or any other necessary services are blocked inadvertently. Ensure there is an outbound rule allowing traffic from the AVD subnet to Azure DNS (168.63.129.16) or your DNS provider.

If you have any Conditional Access Policies or MFA configured for your account or environment, it could be blocking or complicating the authentication process with NLA enabled. Check the Azure AD logs for any conditional access failures or alerts tied to your login attempts.

Check the logs in the VM’s Event Viewer for failed authentication attempts or networking issues when NLA is enabled. Look into Security logs and Remote Desktop Services Logs.

If you have any further queries, please do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it."
anashetty 255 Reputation points Microsoft Vendor

2024-09-12T11:14:52.62+00:00

Hi Arman Koradia,

Just checking in to see if you had a chance to see my response to your question. Please tell us if it was helpful and feel free to reach out to us if you have any queries.

If you feel that your queries have been resolved, please accept the answer by clicking the "Upvote" and "Accept Answer" on the post.
anashetty 255 Reputation points Microsoft Vendor

2024-09-13T08:43:33.28+00:00

Hi Arman Koradia,

Just checking in to see if you had a chance to see my response to your question. Please tell us if it was helpful and feel free to reach out to us if you have any queries.

If you feel that your queries have been resolved, please accept the answer by clicking the "Upvote" and "Accept Answer" on the post.
Arman Koradia 0 Reputation points

2024-09-13T09:46:06.6366667+00:00
Let me tell you the current scenario and tell you what works and what doesn't.

Working:

Able to successfully authenticate to P2S using Entra ID credentials.

Able to successfully connect to Point-to-Site Connectivity in Azure using Entra ID credentials.

Able to connect to VM in AVD HostPool using Private IP using "Local Admin" account.

Not Working:

Unable to authenticate to VM in AVD HostPool using Entra ID credentials.

Getting error that says "The username or password is incorrect" but that's not the case.

Unable to see the Workspace assigned to user in RDP Client under "Add Workspace"

Getting error that says "Unable to access resources from your current network" even when I am connected to Azure VPN.

I checked Virtual Gateway logs and there are no errors in there. I can see the success messages in there.

I checked Sign-in logs for my user in AD and there also I see success messages for Azure Portal, Azure VPN and Azure Virtual Desktop Client. Despite seeing success message in Entra ID, I am getting error that says username or password incorrect when trying to connect to AVD VM from Remote Desktop Client.

Now regarding the NLA part, I have not enabled it since I need to fix this to make it work.
I also tried your suggestion of adding DNS server in VPN Config. But before that let me clarify that for this VNet I am by default using "Azure-Provided" DNS server.
I switched it to Custom and gave the IP you provided and tried to connect to VPN. I could see the DNS server change reflecting in my VPN connection but that disrupts my entire connectivity.
I am not able to connect to Internet or VM from my local laptop when I am connected to VPN that uses custom DNS server IP.

In RDP Properties of my AVD HostPool, I have targetisaadjoined:i:1; and enablerdsaadauth:i:1 set already. My device is Entra Joined. My user have VM User Login permission also granted on Application Group and on Resource Group (I am Global Admin though)

MFA is configured for my user but no Conditional Access Policies are set up. Just simple MFA policy is present for which I don't see any failure logs.

I don't see any failure logs in Event Viewer of my VM under Remote Desktop Services. Just the heartbeat informational logs present there.
Arman Koradia 0 Reputation points

2024-09-13T11:24:09.97+00:00
Quick update from some config changes that I tried:

I disabled the MFA for my user and I was able to connect to AVD VM using the Entra ID credentials (using Add PC option in Microsoft Remote Desktop)

I enabled the Public Access of AVD HostPool and AVD Workspace and I was able to connect to VM using the Entra ID credentials (despite having MFA enabled for my user).

Now my only requirement is how to achieve point 2 i.e. to be able to connect to AVD Workspace using P2S connectivity and disabling Public Access for the AVDHostPool and AVD Workspace?

I see the issue is when I try to set the AVD Workspace Private. That's when the connection breaks and I see an error that says "Unable to access resources from your current network". When I set AVD HostPool networking to "Enable public access for end users, use private access for session hosts" and Workspace Networking to "Enable public access from all networks" everything works as expected.
anashetty 255 Reputation points Microsoft Vendor

2024-09-13T13:34:16.63+00:00

Hi Arman Koradia,

Thank you for getting back with the detailed explanation.

The main problem appears to be related to network accessibility when configuring the AVD Workspace to private mode while using P2S connectivity. The issue occurs when public access is turned off and the AVD Workspace is set to private. Here are some suggestions you can try to resolve the issue.

As switching to a custom DNS server caused connectivity issues, ensure that DNS resolution for private endpoints (used by AVD when public access is disabled) is properly set up. If you’re utilizing Azure Private DNS zones, check that the necessary records for your AVD Workspace are correctly configured in the private DNS zone.

Sometimes the Remote Desktop Client may cache incorrect network details. Try clearing any stored credentials and cached network settings in the RDP client or try using a different device to test the connection.

In cases where private access is used, the session hosts in the AVD HostPool must also have access to the private endpoint of the AVD Workspace. Ensure that both are in the same VNet or peered VNets with proper routing in place.

If you have any further queries, please do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it."
Arman Koradia 0 Reputation points

2024-09-15T08:11:47.83+00:00

Hey,

Thanks for trying your best to help but this doesn't seem to help me since I am not getting any concrete stuff on what to fix and where.

Based on my troubleshooting, I know its something related to network. Whether it is Private Link or Network Security Group on my VNet.

When I try to add Workspace URL in my Remote Desktop Client i.e. https://client.wvd.microsoft.com, it finds the feed discovery URL that is available for my Tenant.

To be accurate, the URL resolves to one of the record present in privatelink.wvd.microsoft.com Private DNS Zone created while creating private link for AVD Host Pool. It points to an IP present in one of the subnet I created for PrivateEndpoints in my VNet.

It then prompts me for username and password and when I login I see the error that says "Unable to access resources from your current network."

There is only 1 NSG attached to my subnet and below are the inbound and outbound rules respectively.

Inbound:

Outbound:

If you have any specific config changes suggestions, please let me know. I am pretty much sure it is related to the network configuration where the link is getting broken.

2 answers

Arman Koradia 0 Reputation points

2024-09-17T10:04:18.4033333+00:00
For anyone who is trying to achieve the following scenario, I am describing the end-to-end setup steps so that they don't waste time figuring things out like I did.

Scenario: Access Azure Virtual Desktop using Private Link from Point-2-Site VPN(or Site-to-Site VPN) that uses Azure Entra ID authentication and SSO

You will need the following resources:

VNet with different subnets (AVD HostPool, PrivateEndpoints, Gateway)

AVD HostPool and PrivateEndpoints subnets created with no outbound connectivity

Gateway Subnet is automatically created

Expose the Service Endpoint for Azure Active Directory in subnets

NSG blocking 443 Outbound attached on AVD HostPool Subnet

This will block internet traffic from AVD. Tune as per your requirements

VPN Gateway with Point-to-Site Connection configurations done.

Add the VNet CIDR in "Advertised Route" in P2S configuration.

I used Azure Public value as "41b23e61-6c1e-4545-b367-cd054e0ed4b4"

Azure Virtual Desktop Host Pool

Create Private Endpoint and Disable all Public Access on the HostPool

In Microsoft Entra ID SSO, select "Connections will use Entra ID SSO"

Azure Virtual Desktop Application Group

Azure Virtual Desktop Workspace

Create Private Endpoints (Global and Feed) and Disable Public Access from all networks

DNS Private Zones will be created for AVD HostPool Private Endpoint and AVD Workspace Private Endpoint (Global) automatically. Don't change config here.

DNS Private Resolver (Inbound Endpoint)

Create additional subnet with /28 CIDR for this in the same VNet.

Use the Inbound IP that gets allocated in Private Resolver as Custom DNS in VNet

Once all this configuration is completed, install Azure VPN Client and Microsoft Remote Desktop app on your laptop (Windows/Linux/Mac)

Download the VPN config from P2S config blade in VPN Gateway.

Open azurevpnconfig.xml file and add following config there.

Save and Import this profile into Azure VPN Client installed and try to connect using your Entra ID credentials.

Once connected, use "nslookup" to check if https://rdweb.wvd.microsoft.com or https://client.wvd.microsoft.com resolves to Private IP.

If yes, use that URL to add workspace in your Microsoft Remote Desktop app and you should be able to connect there. Please let me know incase you need additional information to get this work.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
anashetty 255 Reputation points Microsoft Vendor

2024-09-17T10:26:15.9833333+00:00
Hi Arman Koradia,

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Issue:

Cannot connect to Azure Virtual Desktop using Point-to-Site from macOS RDP Client

Solution:

Scenario: Access Azure Virtual Desktop using Private Link from Point-2-Site VPN(or Site-to-Site VPN) that uses Azure Entra ID authentication and SSO

You will need the following resources:

VNet with different subnets (AVD HostPool, PrivateEndpoints, Gateway)

AVD HostPool and PrivateEndpoints subnets created with no outbound connectivity

Gateway Subnet is automatically created

Expose the Service Endpoint for Azure Active Directory in subnets

NSG blocking 443 Outbound attached on AVD HostPool Subnet

This will block internet traffic from AVD. Tune as per your requirements

VPN Gateway with Point-to-Site Connection configurations done.

Add the VNet CIDR in "Advertised Route" in P2S configuration.

I used Azure Public value as "41b23e61-6c1e-4545-b367-cd054e0ed4b4"

Azure Virtual Desktop Host Pool

Create Private Endpoint and Disable all Public Access on the HostPool

In Microsoft Entra ID SSO, select "Connections will use Entra ID SSO"

Azure Virtual Desktop Application Group

Azure Virtual Desktop Workspace

Create Private Endpoints (Global and Feed) and Disable Public Access from all networks

DNS Private Zones will be created for AVD HostPool Private Endpoint and AVD Workspace Private Endpoint (Global) automatically. Don't change config here.

DNS Private Resolver (Inbound Endpoint)

Create additional subnet with /28 CIDR for this in the same VNet.

Use the Inbound IP that gets allocated in Private Resolver as Custom DNS in VNet

Once all this configuration is completed, install Azure VPN Client and Microsoft Remote Desktop app on your laptop (Windows/Linux/Mac)

Download the VPN config from P2S config blade in VPN Gateway.

Open azurevpnconfig.xml file and add following config there.

Save and Import this profile into Azure VPN Client installed and try to connect using your Entra ID credentials.

Once connected, use "nslookup" to check if https://rdweb.wvd.microsoft.com or https://client.wvd.microsoft.com resolves to Private IP.

If yes, use that URL to add workspace in your Microsoft Remote Desktop app and you should be able to connect there. Please let me know in case you need additional information to get this work.

If you have any other questions or are still running into more issues, please let me know. Thank you again for your time and patience throughout this issue.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Thank you.
Please sign in to rate this answer.
anashetty 255 Reputation points Microsoft Vendor

2024-09-18T13:36:55.4066667+00:00

Hi Arman Koradia,

I have reposted your solution as Answer as the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others "

If you have any other questions or are still running into more issues, please let me know. Thank you again for your time and patience throughout this issue.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Cannot connect to Azure Virtual Desktop using Point-to-Site from macOS RDP Client

2 answers

Your answer