Kerberos authentication in Azure Bastion

Question

We have recently enabled Kerberos authentication on Azure Bastion. Since then, we are experiencing issues when attempting to sign in using the UPN format: ******@contoso.com This format previously worked without issue, but it is no longer functioning as expected.

Currently, only the following login formats appear to work, and even then, inconsistently:

• username@<on-premises domain>
• username (without any domain suffix)

This behavior is affecting usability and access consistency, especially for users who are accustomed to using their UPN for authentication.

Answer 1

AFAIK, if you're not signing in by using UPN, you are not using Kerberos.

Review the considerations available at https://learn.microsoft.com/en-us/azure/bastion/kerberos-authentication-portal#considerations and make sure that they do apply to your deployment.

Btw. your post seems to imply a mismatch between the UPN used in your AD DS environment and Entra ID (in general, they should match)

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin