Azure VM User Access Rights

Question

Hello,

I spun up an Azure VM and connected it to my Intune via my global admin Entra ID credentials in the "access work or school" section of the settings. After doing so, I went into Intune, made a new configuration policy, and under user rights added a few users under "allow local login". I added the VM to a group and assigned the configuration to the group. When I look at the device, Intune reports that it was successfully applied.

When I try to login with a standard user that is on the user rights list, I get a "The connection was denied because the user account is not authorized for remote login." error. So I went to lusrmgr.msc and tired to add the user to the "remote desktop users" group. However, I cannot add these users because it is not showing my Azure domain as an avialable location.

When another global admin who is not on my user access list tries to sign in, he can do so successfully.

Am I missing something here? Is there another "Allow remote login" user access rights that I may be missing? Something tells me this should be that hard, and it's throwing me for a loop.

My end goal is to restrict the VM to only the allowed users list and get them to be able to login. I would rather not have users maintain a local account and password, but if I can't figure this out, we may have to go that route.

Answer 1

@Michael Malambri, Thanks for sharing the solution. I am glad the issue is fixed. To help others quickly find the solution, please let me write a summary for our issue.

Issue

Get a "The connection was denied because the user account is not authorized for remote login." error when access Azure VM.

Resolution

Again, thanks for your time and have a nice day!

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

For anyone else having this issue...

The fix for me to was to ensure that I granted access to accounts directly on the virtual machine IAM itself using the roles "Virtual Machine User Login" and "Virtual Machine Administrator Login". You cannot do this on the resource group level. It has to be done on the machine level in azure.

Also, I thought you had to make a new conditional access policy to exclude "Microsoft Azure Windows Virtual Machine Sign In". Do not do that. Look for your existing MFA conditional access policy and add the exclusion there.

These two things fixed my issue. Thank you for your support.

Answer 3

@Michael Malambri, Thanks for posting in Q&A. To clarify our issue, please choose one affected device and check the following information.

1, Type gpedit.msc to open local group policy editor.

2, Navigate to the following location to check the setting "Allow log on locally" to see what users and group included. Please confirm if it is the same as the one you configured. And if there's any group which may include the global admin you test.

Meanwhile, to add Microsoft Entra user into local group, you can add them via Local user group membership policy.

https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-account-protection-policy#manage-local-groups-on-windows-devices

Please check the above information and if there's any update, feel free to let us know.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.