How can I get my VMs with AADLoginForWindows extension installed to actually use EntraID for login?

Question

How can I get my VMs with AADLoginForWindows extension installed to actually use EntraID for login?

Ryan Kimber 0

I have provisioned a scale set using Terraform, and an image using Packer.

My scale set is up and running, the VMs can be accessed using Bastion and the Administrator account.

I can see that the AADLoginForWindows 2.2.0 extension has been installed and is joining the VM to EntraID.

However, then I try to login using EntraID credentials, the machine seems to try NTML authentication and rejects me. I don't see any Azure AD or Entra ID credential providers in the registry at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers.

Also, Bastion doesn't show me an option for an EntraId login. The options are VM Password and Password from Azure Key Vault.

What else am I missing?

Sanoop M 4,345 Reputation points Moderator

2025-03-03T20:23:52.97+00:00
Hello @Ryan Kimber,

Thank you for posting your query on Microsoft Q&A.

Please make sure if you have followed all the instructions as mentioned below to sign in to the Windows Virtual Machines using Microsoft Entra ID credentials.

Network requirements

To enable Microsoft Entra authentication for your Windows VMs in Azure, you need to ensure that your VM's network configuration permits outbound access to the following endpoints over TCP port 443.

Azure Global:

https://enterpriseregistration.windows.net: For device registration.

http://169.254.169.254: Azure Instance Metadata Service endpoint.

https://login.microsoftonline.com: For authentication flows.

https://pas.windows.net: For Azure RBAC flows.

Azure Government:

https://enterpriseregistration.microsoftonline.us: For device registration.

http://169.254.169.254: Azure Instance Metadata Service endpoint.

https://login.microsoftonline.us: For authentication flows.

https://pasff.usgovcloudapi.net: For Azure RBAC flows.

Microsoft Azure operated by 21Vianet:

https://enterpriseregistration.partner.microsoftonline.cn: For device registration.

http://169.254.169.254: Azure Instance Metadata Service endpoint.

https://login.chinacloudapi.cn: For authentication flows.

https://pas.chinacloudapi.cn: For Azure RBAC flows.

Authentication requirements

Microsoft Entra Guest accounts can't connect to Azure VMs or Azure Bastion enabled VMs via Microsoft Entra authentication.

Enable Microsoft Entra login for a Windows VM in Azure

To use Microsoft Entra login for a Windows VM in Azure, you must:

Enable the Microsoft Entra login option for the VM.

Configure Azure role assignments for users who are authorized to sign in to the VM.

There are two ways to enable Microsoft Entra login for your Windows VM:

The Azure portal, when you're creating a Windows VM.

Azure Cloud Shell, when you're creating a Windows VM or using an existing Windows VM.

If you are creating a Windows VM through Azure portal, please make sure to enable the Microsoft Entra login option for the VM by following the below mentioned steps.

On the Management tab, select the Login with Microsoft Entra ID checkbox in the Microsoft Entra ID section.

Please refer to the below Screenshot for your reference.

Make sure that System assigned managed identity in the Identity section is selected. This action should happen automatically after you enable login with Microsoft Entra ID.

Note

To sign in to the VM by using your Microsoft Entra credentials, you first need to configure role assignments for the VM.

Note

You must enable system-assigned managed identity on your virtual machine before you install the Microsoft Entra login VM extension. Managed Identities are stored in a single Microsoft Entra tenant and currently do not support cross directory scenarios.

Bastion does work with Entra ID extension-joined VMs for Microsoft Entra users with RDP and SSH on the native client, and SSH only on the portal. Entra ID for RDP on the portal is not yet supported.

If the legacy Per-user MFA is Enabled/Enforced for your user account , please make sure to disable the Per-User MFA by following the below mentioned steps.

To change the per-user Microsoft Entra multifactor authentication state for a user, complete the following steps:

Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.

Browse to Identity > Users > All users.

Select a user account, and then select Per-user MFA.

Search for the affected user and check the Per-user MFA status. If it is enabled, please select Disable MFA.

Since you have mentioned that when you try to login to VM using EntraID credentials, the machine seems to try NTML authentication and rejects you. Also you don't see any Azure AD or Entra ID credential providers in the registry at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers.

So could you please provide the error message screenshot(if applicable).

For additional information, please refer to the below document for your reference which will be helpful.

Sign in to a Windows virtual machine in Azure by using Microsoft Entra ID - Microsoft Entra ID | Microsoft Learn
Ryan Kimber 0 Reputation points

2025-03-04T01:34:47.1266667+00:00

Since I'm using Terraform to create the host pool and scale set, I was hoping that there will be a Terraform way to apply the VM settings to enable EntraID login.

Is there a setting I can pass to the VM when it's provisioned, or an Azure az call I can make that would change the setting on the VM to allow EntraId logins?

This is my VM configuration for the scale set: resource "azurerm_windows_virtual_machine_scale_set" "hosts" {

name = "hostpool-${var.module_name}-${var.environment}-scale-set"

location = var.location

resource_group_name = azurerm_resource_group.workstations_resource_group.name

sku = var.vm_size

instances = var.min_number_of_session_hosts

admin_username = var.desktop_admin_username

admin_password = var.desktop_admin_password

computer_name_prefix = "dev-wkstn" # Maximum of 9 characters.

tags = var.tags

depends_on = [data.azurerm_resources.image_versions_by_tag]

source_image_id = data.azurerm_resources.image_versions_by_tag.resources[0].id

identity {

type = "SystemAssigned"

}

os_disk {

caching = "ReadWrite"

storage_account_type = "StandardSSD_LRS"

}

network_interface {

name = "vmss-nic"

primary = true

ip_configuration {

name = "internal"

primary = true

subnet_id = azurerm_subnet.avd_session_hosts_subnet.id

}

}

}

Enable Azure AD login for Windows VMs in the scale set

A useful command to run on a VM to see it's registration status is: dsregcmd /status

resource "azurerm_virtual_machine_scale_set_extension" "aad_join" {

name = "AADLoginForWindows"

virtual_machine_scale_set_id = azurerm_windows_virtual_machine_scale_set.hosts.id

publisher = "Microsoft.Azure.ActiveDirectory"

type = "AADLoginForWindows"

type_handler_version = "2.2"

auto_upgrade_minor_version = false

}

2 answers

Your answer

Ryan Kimber 0 Reputation points

2025-03-04T01:34:47.1266667+00:00

Since I'm using Terraform to create the host pool and scale set, I was hoping that there will be a Terraform way to apply the VM settings to enable EntraID login.

Is there a setting I can pass to the VM when it's provisioned, or an Azure az call I can make that would change the setting on the VM to allow EntraId logins?

This is my VM configuration for the scale set: resource "azurerm_windows_virtual_machine_scale_set" "hosts" {

name = "hostpool-${var.module_name}-${var.environment}-scale-set"

location = var.location

resource_group_name = azurerm_resource_group.workstations_resource_group.name

sku = var.vm_size

instances = var.min_number_of_session_hosts

admin_username = var.desktop_admin_username

admin_password = var.desktop_admin_password

computer_name_prefix = "dev-wkstn" # Maximum of 9 characters.

tags = var.tags

depends_on = [data.azurerm_resources.image_versions_by_tag]

source_image_id = data.azurerm_resources.image_versions_by_tag.resources[0].id

identity {

type = "SystemAssigned"

}

os_disk {

caching = "ReadWrite"

storage_account_type = "StandardSSD_LRS"

}

network_interface {

name = "vmss-nic"

primary = true

ip_configuration {

name = "internal"

primary = true

subnet_id = azurerm_subnet.avd_session_hosts_subnet.id

}

}

}

Enable Azure AD login for Windows VMs in the scale set

A useful command to run on a VM to see it's registration status is: dsregcmd /status

resource "azurerm_virtual_machine_scale_set_extension" "aad_join" {

name = "AADLoginForWindows"

virtual_machine_scale_set_id = azurerm_windows_virtual_machine_scale_set.hosts.id

publisher = "Microsoft.Azure.ActiveDirectory"

type = "AADLoginForWindows"

type_handler_version = "2.2"

auto_upgrade_minor_version = false

}

Answer 1

Hello @Ryan Kimber,

Thank you for your response.

I understand that you are using Terraform to create the host pool and scale set.

Please note that you can use Terraform to create Windows Virtual Machine and I am attaching you the document below for detailed guide for your reference.

Quickstart: Use Terraform to create a Windows VM - Azure Virtual Machines | Microsoft Learn

Please note that there are only two ways to enable Microsoft Entra login for your Windows VM:

Please refer to the below Screenshot for your reference.

User's image

Please note that you can use Azure Cloud Shell to enable Microsoft Entra login for your Windows VM.

Please refer to the below document for the detailed guide for your reference.

https://learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-windows?source=recommendations#azure-cloud-shell

At this time, you can use Azure Bastion to log in with Microsoft Entra authentication via the Azure CLI and the native RDP client mstsc.

Please refer to the below table Screenshot to know in what methods Microsoft Entra authentication login to Virtual Machines is currently supported.

User's image

Please refer to the below document for your reference.

Configure Bastion for native client connections - Azure Bastion | Microsoft Learn

I hope this above information provided is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Sanoop M 4,345 Reputation points Moderator

2025-03-06T18:45:42.3733333+00:00

Hello @Ryan Kimber,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query please do let us know.
Sanoop M 4,345 Reputation points Moderator

2025-03-07T23:14:05.61+00:00

Hello @Ryan Kimber,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query please do let us know.

Answer 2

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more