AVD - Sign in failed. Please check your username and password and try again. Despite vm joined to entra ad, rbacs assigned, double checked password

Question

AVD - Sign in failed. Please check your username and password and try again. Despite vm joined to entra ad, rbacs assigned, double checked password

Uri Zafrir 0

Hello

I've set up AVD using terraform, something like the example here in this link :

(I also tried creating the VM in the host pool manually)

https://github.com/Azure/terraform-azurerm-avm-res-desktopvirtualization-hostpool/blob/main/examples/default/main.tf

I've also added the role "Virtual Machine Administrator Login" to my user. User's image

I can see the VM in the host pool is available

User's image

I can see the AAD join extension is ok

User's image

Inside the VM, I can see it's joined to the entra AD.

User's image

But I still get this error: User's image

this is the output of dsregcmd /status:

PowerShellCopy



+----------------------------------------------------------------------+
| Device State                                                         |
+----------------------------------------------------------------------+

             AzureAdJoined : YES
          EnterpriseJoined : NO
              DomainJoined : NO
               Device Name : VmAvd-0

+----------------------------------------------------------------------+
| Device Details                                                       |
+----------------------------------------------------------------------+

                  DeviceId : d56544b4-5ad5-42ff-a144-dd4d7ee4f23f
                Thumbprint : 80D2D280EF236A993BB94896B61672246C3F07EE
 DeviceCertificateValidity : [ 2025-03-24 11:35:38.000 UTC -- 2035-03-24 12:05:38.000 UTC ]
            KeyContainerId : 1c8da503-8a45-4b72-9e50-51b3aa3e6283
               KeyProvider : Microsoft Software Key Storage Provider
              TpmProtected : NO
          DeviceAuthStatus : SUCCESS

|
+----------------------------------------------------------------------+

                TenantName : <redacted>
                  TenantId : a775278c-ce63-45e6-9667-524bec91ab1b
                eregistration.windows.n
+----------------------------------------------------------------------+
| User State                                                           |
+----------------------------------------------------------------------+

                    NgcSet : NO
           WorkplaceJoined : NO
             WamDefaultSet : NO

+----------------------------------------------------------------------+
| SSO State                                                            |
+----------------------------------------------------------------------+

                AzureAdPrt : NO
       AzureAdPrtAuthority :
             EnterprisePrt : NO
    EnterprisePrtAuthority :

+----------------------------------------------------------------------+
| Diagnostic Data                                                      |
+----------------------------------------------------------------------+

        AadRecoveryEnabled : NO
    Executing Account Name : VmAvd-0\adminuser
               KeySignTest : PASSED

        DisplayNameUpdated : YES
          OsVersionUpdated : YES
           HostNameUpdated : YES

      Last HostName Update : NONE

+----------------------------------------------------------------------+
| IE Proxy Config for Current User                                     |
+----------------------------------------------------------------------+

      Auto Detect Settings : YES
    Auto-Configuration URL :
         Proxy Server List :
         Proxy Bypass List :

+----------------------------------------------------------------------+
| WinHttp Default Proxy Config                                         |
+----------------------------------------------------------------------+

               Access Type : DIRECT

+----------------------------------------------------------------------+
| Ngc Prerequisite Check                                               |
+----------------------------------------------------------------------+

            IsDeviceJoined : YES
             IsUserAzureAD : NO
             PolicyEnabled : NO
          PostLogonEnabled : YES
            DeviceEligible : NO
        SessionIsNotRemote : NO
            CertEnrollment : none
              PreReqResult : WillNotProvision

For more information, please visit https://www.microsoft.com/aadjerrors

I've tried logging in with my user to test local entra ad connectivity , but i get the same error: User's image

Please help!

Marten Theunissen 676 Reputation points

2025-03-24T13:11:17.5866667+00:00

Good Day,

Please confirm steps below.

Verify Credentials:

Ensure that the username and password you are using are correct. Double-check for any typos or incorrect characters.

Check Role Assignments:

Ensure that the user has the necessary role assignments:

Virtual Machine User Login: Assign this role to the AVD users.

Virtual Machine Administrator Login: Assign this role to the AVD admins1.

Review Conditional Access Policies:

Check if any Conditional Access policies are affecting the sign-in process. Ensure that the Azure Windows VM sign-in cloud application is excluded from MFA requirements2.

Update RDP Properties:

If you are using the web client, update the RDP properties of the host pool:

Go to the host pool settings.

Select "RDP Properties" > "Advanced."

Add the property targetisaadjoined:i:11.

Check Azure Virtual Desktop Agent:

Ensure that the Azure Virtual Desktop Agent is running correctly:

Open Event Viewer and navigate to Windows Logs > Application.

Look for events with sources like WVD-Agent, WVD-Agent-Updater, RDAgentBootLoader, and MsiInstaller3.

Restart the Remote Desktop Agent Loader service if needed

Check Device State in Azure Portal:

Sign in to the Azure Portal.

Navigate to "Azure Active Directory" > "Devices" > "All devices."

Ensure that the device is listed and its status is "Registered
Nikhil Duserla 6,550 Reputation points Microsoft External Staff

2025-03-24T13:41:20.4033333+00:00

Hi @Uri Zafrir,

Please reach out here- https://learn.microsoft.com/en-us/answers/questions/2238199/avd-sign-in-failed-please-check-your-username-and
Uri Zafrir 0 Reputation points

2025-03-24T14:12:45.64+00:00

Hi Nikhil, since Marten commented here I would like to continue here. Hope that's ok.

As per the previous post, I've verified the credentials.

As per the picture in the previous post, i've verified the RBAC,

I don't have any conditional access policies,

I already have the RDP setting applied,

Showing here some pictures from event viewer,

didn't find any WVD-Agent-Updater logs

Enclosed a picture from device:

All seems ok, What should I do then?
Vamsi Ram Annepu 480 Reputation points Microsoft External Staff

2025-03-26T18:03:35.65+00:00

Hi Uri Zafrir,
Could you give us the further details in private messaging.

Your answer

Marten Theunissen 676 Reputation points

2025-03-24T13:11:17.5866667+00:00

Good Day,

Please confirm steps below.

Verify Credentials:

Ensure that the username and password you are using are correct. Double-check for any typos or incorrect characters.

Check Role Assignments:

Ensure that the user has the necessary role assignments:

Virtual Machine User Login: Assign this role to the AVD users.

Virtual Machine Administrator Login: Assign this role to the AVD admins1.

Review Conditional Access Policies:

Check if any Conditional Access policies are affecting the sign-in process. Ensure that the Azure Windows VM sign-in cloud application is excluded from MFA requirements2.

Update RDP Properties:

If you are using the web client, update the RDP properties of the host pool:

Go to the host pool settings.

Select "RDP Properties" > "Advanced."

Add the property targetisaadjoined:i:11.

Check Azure Virtual Desktop Agent:

Ensure that the Azure Virtual Desktop Agent is running correctly:

Open Event Viewer and navigate to Windows Logs > Application.

Look for events with sources like WVD-Agent, WVD-Agent-Updater, RDAgentBootLoader, and MsiInstaller3.

Restart the Remote Desktop Agent Loader service if needed

Check Device State in Azure Portal:

Sign in to the Azure Portal.

Navigate to "Azure Active Directory" > "Devices" > "All devices."

Ensure that the device is listed and its status is "Registered
Nikhil Duserla 6,550 Reputation points Microsoft External Staff

2025-03-24T13:41:20.4033333+00:00

Hi @Uri Zafrir,

Please reach out here- https://learn.microsoft.com/en-us/answers/questions/2238199/avd-sign-in-failed-please-check-your-username-and
Uri Zafrir 0 Reputation points

2025-03-24T14:12:45.64+00:00

Hi Nikhil, since Marten commented here I would like to continue here. Hope that's ok.

As per the previous post, I've verified the credentials.

As per the picture in the previous post, i've verified the RBAC,

I don't have any conditional access policies,

I already have the RDP setting applied,

Showing here some pictures from event viewer,

didn't find any WVD-Agent-Updater logs

Enclosed a picture from device:

All seems ok, What should I do then?
Vamsi Ram Annepu 480 Reputation points Microsoft External Staff

2025-03-26T18:03:35.65+00:00

Hi Uri Zafrir,
Could you give us the further details in private messaging.

Share via

AVD - Sign in failed. Please check your username and password and try again. Despite vm joined to entra ad, rbacs assigned, double checked password

Your answer