Windows Server VM and Azure Entra ID Login via RDP: The sign-in method you're trying to use isn't allowed.

Question

Hello! I have provisioned a Windows Server 2025 machine and have enabled Entra ID Login at setup. Long story short, when I attempt to log in using RDP, I get an error that says "The sign-in method you're trying to use isn't allowed."

Here's what I know:

• AADLogin extension on the VM is successfully provisioned and up to date (v.2.2.0.0)
• The necessary users have a Role Assignment of "Virtual Machine Administrator Login" ( these users need to be admins on this VM)
• I have disabled "Network Level Authentication" in remote desktop settings within the VM (because of how the clients need to access through Remote Desktop Connection)
• The output of dsregcmd /status notes that the machine is AzureADJoined but mentions an error about MFA (see below).
• User is using Windows App on MacOS to access the VM, and the username is being input as AzureAD\******@domain.com

Output of dsregcmd /status:

PS > dsregcmd /status
+----------------------------------------------------------------------+
| Device State                                                         |
+----------------------------------------------------------------------+
             AzureAdJoined : YES
          EnterpriseJoined : NO
              DomainJoined : NO
           Virtual Desktop : NOT SET
               Device Name : 

Answer 1

Hello @Steve Sanda

Based on your description, I can see that you’ve already verified most of the prerequisite requirements. However, I suggest checking the following additional points:

• Per-user MFA: Ensure that the user is not enabled or enforced in per-user MFA settings.
• Conditional Access Policies: If there is a Conditional Access policy requiring MFA, please make sure to exclude the "Microsoft Azure Windows Virtual Machine Sign-in" app (App ID: 372140e0-b3b7-4226-8ef9-d57986796201) from the targeted cloud apps.

Also, make sure you meet this condition:

Remote connections to VMs that are joined to Microsoft Entra ID are only allowed from Windows 10 or later PCs that are either Microsoft Entra registered (minimum build 20H1), Entra joined, or Entra hybrid joined to the same directory as the VM.

For reference, see this Microsoft Learn article: Sign in to a Windows virtual machine in Azure by using Microsoft Entra ID.

If MFA isn’t enabled through per-user MFA or conditional access policy and still unable to login into VM.

Try to if Security Defaults were enabled in your tenant. While Security Defaults typically do not affect non-admin users signing into a VM, they do require Global Administrators to complete MFA. If your account has the Global Administrator role assigned, MFA is still being enforced due to Security Defaults. As per design we can’t login into the Azure VM with Microsoft Entra ID user if the MFA is being applied on VM login.

To work around this, create a new Global Administrator account and a backup admin account, then remove the Global Administrator role from your main account. This allows you to sign in to the VM without being prompted for MFA.

If you are still unable to sign in to the VM using Entra ID credentials, please share your email address and availability for a call over private message, and I’d be happy to assist you further.