Unable to login to VM by Azure AD guest connected to Azure Active Directory Domain Service

Question

I have an Azure Active Directory (AD) with guest users invited via email and s few others that are manually created.
I have an Azure AD Domain Service (DS) set up to allow VM to connect to the domain.

I can log to the VM using the manually created users in Azure AD, by their User Principal Name (UPN) e.g., user@keyman .onmicrosoft.com.

My other guest users are not able to log in to the VM with their UPN e.g., GuestInvitationEmail#EXT#@keyman .onmicrosoft.com.
I tried to change the guest user to member and it still does not work.

Any suggestion to solve this issue ?
I need to allow these guest users to be able to log in to the VM with their AD credentials.

Also, seems that I cannot modify the UPN of guest (members after modification) users and make it more usable and not too long.

Answer 1

@MADHUN Ahmed ,

The guest user is always from a different tenant or can be an external user not on Azure Active directory at all . In order to signin to a Virtual machine which is joined to Azure AD domain services instance you need NTLM password hashes to be available for these users . Since the password for these guest users are not stored within the same tenant hence they wont be able to signin in this case and this is by design. Please check the section in FAQ for AAD domain services. For any user who was created locally within your Azure AD instance the password will be stored either on Azure AD or synced from On-premise if they are synced users . When you enabled Azure AD domain services , the NTLM hashes for those users will be generated and it will be synced to your Azure AD domain services instance. Thus the password for local users will always be with you and the system will be able to authenticate them while this wont be the case for any user who was not from within the domain . When you have a Azure VM joined to the Azure AD domain services domain it will authenticate using the NTLM/kerberos auth from users form the domain . Hope this clarified your query . Please find the document reference for the same.

Can guest users be invited to my directory use Azure AD Domain Services?
No. Guest users invited to your Azure AD directory using the Azure AD B2B invite process are synchronized into your Azure AD Domain Services managed domain. However, passwords for these users aren't stored in your Azure AD directory. Therefore, Azure AD Domain Services has no way to synchronize NTLM and Kerberos hashes for these users into your managed domain. Such users can't sign in or join computers to the managed domain.

----------------------------------------------------------------------------------------------------------------------------------------------------------

• Please don't forget to click on or upvote button whenever the information provided helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how
• Want a reminder to come back and check responses? Here is how to subscribe to a notification
• If you are interested in joining the VM program and help shape the future of Q&A: Here is how you can be part of Q&A Volunteer Moderators

Answer 2

A solution that worked for me is to use ADConnect and sync hash between On-Prem AD and Azure Active AD. Then I was able to log in to VMs connected to ADDS.