Login issue in AVD

Question

Login issue in AVD

Deepak Kumar 0

Hi, few users are not able to login into AVD as these are in the same group.

Jilakara Hemalatha 7,010 Reputation points Microsoft External Staff Moderator

2025-12-22T20:22:45.8933333+00:00
Hi Deepak Kumar

Thank you for reaching out Q/A.

If some users are experiencing login issues in Azure Virtual Desktop (AVD) despite being part of the same group, the issue is typically related to Conditional Access configuration, role assignments, application group access, or client/device authentication settings, rather than group membership alone.

Please review the following troubleshooting steps and validations.

1.MFA and Conditional Access Policies:

Please verify that there are no Conditional Access (CA) policies enforcing Multi-Factor Authentication (MFA) or blocking token issuance in a way that affects AVD authentication.

If MFA is required, ensure CA policies are scoped correctly and do not unintentionally block the Azure Windows VM Sign-in process.

Incorrect CA scoping can prevent login even when credentials are valid.

Reference: Enforce Microsoft Entra multifactor authentication for Azure Virtual Desktop using Conditional Access

2.User Role Assignments (RBAC)

Please ensure that the affected users have one of the following Azure RBAC roles assigned at the VM, resource group, or subscription level:

Virtual Machine User Login or Virtual Machine Administrator Login

Missing RBAC role assignments are a common cause of AVD login failures, even when users are in the correct group.

AVD Application Group Assignment:

In addition to RBAC roles, users must be assigned to the Application Group associated with the host pool.

If users have VM access but are not assigned to the Application Group, they will not be able to see or connect to the published desktop or applications.

4.Client Device Azure AD Join Status

For AVD authentication using Microsoft Entra ID credentials, the client device should be properly Azure AD joined/hybrid joined.

dsregcmd /status

Verify that the output shows:

AzureAdJoined : YES

AzureAdPrt : YES

5.For Azure AD / Entra ID joined session hosts, certain RDP properties must be configured at the AVD Host Pool level to ensure successful authentication.

Hostedpool >> RDP properties >> Advanced

Ensure the following setting is present:

targetisaadjoined:i:1 -- This setting is required to support Entra ID–based authentication.

6.Event Logs for Further Diagnostics

For deeper troubleshooting, please review the following logs on the affected session hosts:

Event Viewer > Applications and Services Logs > Microsoft > Windows > AAD > Operational

Any errors related to the sign-in attempts would give you more clarity.

Please check above things and let me know the status. Also to know more understand about the issue. Could you please provide below details:

How are users attempting to connect to AVD (Windows App, Remote Desktop client, web client, or another method)?

Total number of users in the group and how many are affected.

Exact error message shown during login (if any).

Were these users able to log in previously, or is this their first attempt?

Any recent changes made to Conditional Access, MFA, roles, or AVD configuration.

Is users are Entra joined users?? If yes, what is the error users getting while logging?

Additionally, could you please check the private message and provide the necessary details.

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello Deepak Kumar,

Thank you for connecting with us offline.

Typically, issues signing in to a VM using Entra ID are related to Multi-Factor Authentication (MFA) being enforced through per-user MFA settings, Security Defaults, or Conditional Access policies.

You can refer to the following documentation to verify and manage the MFA status: Change the status for a user - Microsoft Learn

During our call, we observed that per-user MFA was enabled for your account. As per standard procedure, we disabled it.

User's image

However, the sign-in issue persisted. When we checked Conditional Access policies, there is a policy requiring MFA, please make sure to exclude the "Microsoft Azure Windows Virtual Machine Sign-in" app (App ID: 372140e0-b3b7-4226-8ef9-d57986796201) from the targeted cloud apps.

User's image

This allows you to sign in to the VM without being prompted for MFA.

For reference, see this Microsoft Learn article: Sign in to a Windows virtual machine in Azure by using Microsoft Entra ID.

Hope this helps! Please feel free to reach out for any further queries.

Deepak Kumar 0 Reputation points

2025-12-23T12:58:18.2466667+00:00

i really appreciate your effort Sri and Raja, Thank you so much to connect with us and now i am waiting to connect to our client envirment.

Share via

Login issue in AVD

0 additional answers

Your answer