Troubleshoot connections to Azure AD-joined VMs

Important

This content applies to Azure Virtual Desktop with Azure Resource Manager Azure Virtual Desktop objects.

Use this article to resolve issues with connections to Azure Active Directory (Azure AD)-joined session host VMs in Azure Virtual Desktop.

All clients

Your account is configured to prevent you from using this device

If you come across an error saying Your account is configured to prevent you from using this device. For more information, contact your system administrator, ensure the user account was given the Virtual Machine User Login role on the VMs.

The user name or password is incorrect

If you can't sign in and keep receiving an error message that says your credentials are incorrect, first make sure you're using the right credentials. If you keep seeing error messages, check to make sure you've fulfilled the following requirements:

  • Have you assigned the Virtual Machine User Login role-based access control (RBAC) permission to the virtual machine (VM) or resource group for each user?
  • Does your Conditional Access policy exclude multi-factor authentication requirements for the Azure Windows VM sign-in cloud application?

If you've answered "no" to either of those questions, you'll need to reconfigure your multi-factor authentication. To reconfigure your multi-factor authentication, follow the instructions in Enforce Azure Active Directory Multi-Factor Authentication for Azure Virtual Desktop using Conditional Access.

Important

VM sign-ins don't support per-user enabled or enforced Azure AD Multi-Factor Authentication. If you try to sign in with multi-factor authentication on a VM, you won't be able to sign in and will receive an error message.

If you can access your Azure AD sign-in logs through Log Analytics, you can see if you've enabled multi-factor authentication and which Conditional Access policy is triggering the event. The events shown are non-interactive user login events for the VM, which means the IP address will appear to come from the external IP address that your VM accesses Azure AD from.

You can access your sign-in logs by running the following Kusto query:

let UPN = "userupn";
AADNonInteractiveUserSignInLogs
| where UserPrincipalName == UPN
| where AppId == "38aa3b87-a06d-4817-b275-7a316988d93b"
| project ['Time']=(TimeGenerated), UserPrincipalName, AuthenticationRequirement, ['MFA Result']=ResultDescription, Status, ConditionalAccessPolicies, DeviceDetail, ['Virtual Machine IP']=IPAddress, ['Cloud App']=ResourceDisplayName
| order by ['Time'] desc

Windows Desktop client

The logon attempt failed

If you come across an error saying The logon attempt failed on the Windows Security credential prompt, verify the following:

The sign-in method you're trying to use isn't allowed

If you come across an error saying The sign-in method you're trying to use isn't allowed. Try a different sign-in method or contact your system administrator, you have Conditional Access policies restricting access. Follow the instructions in Enforce Azure Active Directory Multi-Factor Authentication for Azure Virtual Desktop using Conditional Access to enforce Azure Active Directory Multi-Factor Authentication for your Azure AD-joined VMs.

A specified logon session does not exist. It may already have been terminated.

If you come across an error that says, An authentication error occurred. A specified logon session does not exist. It may already have been terminated, verify that you properly created and configured the Kerberos server object when configuring single sign-on.

Web client

Sign in failed. Please check your username and password and try again

If you come across an error saying Oops, we couldn't connect to NAME. Sign in failed. Please check your username and password and try again. when using the web client, ensure that you enabled connections from other clients.

We couldn't connect to the remote PC because of a security error

If you come across an error saying Oops, we couldn't connect to NAME. We couldn't connect to the remote PC because of a security error. If this keeps happening, ask your admin or tech support for help., you have Conditional Access policies restricting access. Follow the instructions in Enforce Azure Active Directory Multi-Factor Authentication for Azure Virtual Desktop using Conditional Access to enforce Azure Active Directory Multi-Factor Authentication for your Azure AD-joined VMs.

Android and Chrome OS client

Error code 2607 - We couldn't connect to the remote PC because your credentials did not work

If you come across an error saying We couldn't connect to the remote PC because your credentials did not work. The remote machine is AADJ joined. with error code 2607 when using the Android client, ensure that you enabled connections from other clients.

Provide feedback

Visit the Azure Virtual Desktop Tech Community to discuss the Azure Virtual Desktop service with the product team and active community members.

Next steps