How do I enable Entra ID login for my Azure Windows VM?

Question

How do I enable Entra ID login for my Azure Windows VM?

Joseph 0

I want users to sign in to an Azure VM using their Entra ID credentials instead of local accounts. I enabled “Login with Entra ID” in the Azure portal, but the VM still only accepts local admin credentials.

Is there any additional configuration needed on the VM firewall, RDP settings, or Conditional Access side?

0 comments

2 answers

Your answer

Answer 1

VEMULA SRISAI 13,890 Microsoft External Staff Moderator

Hello Joseph,

Thank you for reaching out. Enabling “Login with Microsoft Entra ID” in the portal is the first step, but the VM requires additional configuration to allow Entra ID credentials.

Steps to Enable Entra ID Login

1.Install the AAD Login Extension

Navigate to your VM → Extensions + applications → Add → select Azure AD-based Windows Login.

2.Enable Managed Identity

Under VM → Identity, turn on System assigned managed identity and save.

**3.**Assign Required Roles Assign users one of these roles at the VM scope:

Virtual Machine Administrator Login
Virtual Machine User Login Use Access Control (IAM) in the VM blade.

Verify VM Join Status On the VM, run:

dsregcmd /status

Confirm AzureAdJoined : YES.

4Update RDP Settings Download the RDP file from Connect → RDP and add:

enablerdsaadauth:i:1 username:s:******@domain.com

Sign in using AzureAD\******@domain.com.

5.Conditional Access MFA during Windows login isn’t supported. If MFA is enforced, exclude Azure Windows VM Sign-in from MFA policies.

For detailed guidance, see: Sign in to a Windows VM using Microsoft Entra ID.

If you need any additional information or further assistance, please let us know.

VEMULA SRISAI 13,890 Reputation points Microsoft External Staff Moderator

2025-12-06T08:11:30.3833333+00:00

Joseph could please click "Accept Answer" and kindly upvote it, as this will be helpful to other community members facing similar issues. If you have extra questions about this answer, please click "Comment"
Jiaming Wang (Shanghai Wicresoft Co,.Ltd.) 0 Reputation points

2025-12-10T13:02:11.9833333+00:00
Hello @VEMULA SRISAI , I have created the win10-22h2-ent-g2 VM, and done all the steps, but still failed to connect which shown the credentials did not work when I tried to RDP. When I run dsregcmd /status, it doesn't show the words:AzureAdJoined : YES.
It show :

IsDeviceJoined : YES IsUserAzureAD : NO PolicyEnabled : NO PostLogonEnabled : YES DeviceEligible : YES SessionIsNotRemote : YES CertEnrollment : none PreReqResult : WillNotProvision

Answer 2

To enable Microsoft Entra ID login for your Azure Windows VM, you need to ensure that the following configurations are in place:

Entra ID Configuration: Make sure that the VM is joined to Microsoft Entra ID. This is essential for Entra ID authentication to work.
User Roles: Users must belong to one of the two Azure roles: Virtual Machine Administrator Login or Virtual Machine User Login. This is necessary for them to access the VM using their Entra ID credentials.
Remote Desktop Protocol (RDP) Settings: Ensure that the RDP settings are properly configured to allow connections using Entra ID credentials. This includes ensuring that the remote desktop connection is enabled on the VM.
Conditional Access Policies: If your organization uses Microsoft Entra Conditional Access, the device from which users are trying to connect must satisfy the Conditional Access requirements. This may involve configuring policies that allow or restrict access based on certain conditions.
Firewall Settings: Check the firewall settings on the VM to ensure that they allow RDP connections. The default port for RDP is 3389, and it should be open for incoming connections.
Client Requirements: Users must be using a Windows 10 or later PC that is either Microsoft Entra registered or joined to the same directory as the VM.

If you have confirmed all of the above and the issue persists, you may want to review the specific error messages or logs that occur during the login attempt for further troubleshooting.