Cannot login through Remote Desktop with Entra ID

Question

Cannot login through Remote Desktop with Entra ID

Tech Support 5

I have been troubleshooting this for a couple days -

I am able to login to the Azure Virtual Desktop with a local user account that I created, but I am not able to log in with the Entra user ID that is the owner of the account.

I've gone through all the security settings, roles, and permissions but I'm still not able to log in.

We are not on O365 - this is a separate tenant we've created.

Saraswathi Devadula 16,035 Reputation points Microsoft External Staff Moderator

2026-06-24T11:44:14.33+00:00
Hello **Tech Support

**Initially, what you describe (local account can RDP in, but the Entra user/owner account can’t) is typically one of the missing prerequisite layers for Azure Virtual Desktop (AVD) / Entra-joined session host sign-in: RBAC on the VM, Conditional Access / MFA app requirements, or client/app transition requirements.

Here are the key checks based on the provided docs.

1) Confirm the Entra user has VM login RBAC

For Entra ID sign-in to the VM/session host, the user must have the correct Azure role assignment:

Ensure the user is granted Virtual Machine User Login (or Virtual Machine Administrator Login, depending on your intended access) at the VM, resource group, or subscription scope appropriate for the environment.

If this role isn’t assigned, you’ll see errors like “Your account is configured to prevent you from using this device…”.

Note: RBAC updates can take a few minutes to propagate (roughly 5–10 minutes).

2) Check Conditional Access with the correct AVD sign-in apps (and MFA specifics)

AVD sign-in depends on specific Entra applications being allowed by Conditional Access.

Note:

MFA with per-user/enforced methods doesn’t work for VM sign-ins if it’s configured in a way that triggers unsupported flows.

If you’ve enabled MFA, you must review the MFA guidance specifically for Entra joined session hosts.

Conditional Access: make sure you don’t block the required apps

The troubleshooting doc calls out the need to allow the relevant applications for successful login. Depending on your setup, the required apps include:

Azure Virtual Desktop

Windows Azure Active Directory

Windows Cloud Login

Azure Windows VM Sign-In

And the AADJ troubleshooting guidance notes an upcoming transition of the authentication app used by AVD clients:

Clients currently authenticate using the Microsoft Remote Desktop Entra ID app

An upcoming change transitions to the Windows Cloud Login Entra ID app

To avoid breakage, you need to add both Entra ID apps to your Conditional Access policies.

So if your CA is only allowing one of those apps, the owner Entra user may fail while a local account still works.

3) Verify the client/device isn’t causing an authentication mismatch

The docs for Entra VM sign-in call out device/identity aspects for RDP sign-in:

The Windows machine used to initiate RDP generally must be Entra joined/hybrid joined to the same Entra tenant/directory for certain sign-in flows.

There are also specific username formats required in some cases (for example, when using an Entra-registered client) such as AzureAD\UPN.

This won’t usually affect “local user works” vs “Entra user fails” unless the Entra sign-in flow depends on the client device identity, but it’s worth validating.

4) Capture the exact sign-in failure (to pinpoint RBAC vs CA vs MFA)

Best next step: get the failure details from the VM/client side logs so you can tell which layer is blocking sign-in. The Entra VM sign-in troubleshooting notes:

RDP sign-in events are captured in Event Viewer under:

Applications and Services Logs\Microsoft\Windows\AAD\Operational

Look for the error description/codes—those often map directly to RBAC vs Conditional Access vs MFA method issues.

Suggested “quick fix” order (most common)

RBAC: confirm Virtual Machine User Login is assigned to the Entra owner user (or its group) at the right scope.

Conditional Access: confirm your CA policy excludes/permits the required VM sign-in apps and (if applicable) MFA is configured per the AVD Entra joined session host guidance—also ensure you include both the Remote Desktop Entra ID app and Windows Cloud Login app during transition.

Client/device identity: confirm the device initiating RDP meets Entra join requirements for your flow and that you’re using the correct username format.

Event logs: check the AAD Operational log event for the exact error.

https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/windows/troubleshoot-rdp-connection
https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-desktop/troubleshoot-azure-ad-connections
https://learn.microsoft.com/en-us/azure/virtual-desktop/authentication
https://learn.microsoft.com/en-us/azure/virtual-desktop/set-up-mfa?tabs=avd#create-a-conditional-access-policy
Tech Support 5 Reputation points

2026-06-24T11:47:48.5733333+00:00

I've attempted these steps, and have even disabled the default security settings to make sure that MFA was not blocking it. I'm still not able to log in to the desktop with the Entra ID. I'm able to log in to the Azure Portal with the Entra ID, and I'm able to log into the Virtual Desktop with the local user account that was created.

Your answer

Tech Support 5 Reputation points

2026-06-24T11:47:48.5733333+00:00

I've attempted these steps, and have even disabled the default security settings to make sure that MFA was not blocking it. I'm still not able to log in to the desktop with the Entra ID. I'm able to log in to the Azure Portal with the Entra ID, and I'm able to log into the Virtual Desktop with the local user account that was created.