AAD authentication to Azure Windows Server 2019 virtual machine

user_3382478 0
Viewed 2380

I'm having issues authenticating my Azure Windows Server 2019 virtual machine with my AAD user.

According to Microsoft's documentation: https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows, I've created Azure Windows Server 2019 VM using Terraform and installed Windows AAD authentication extension using:

  provisioner "local-exec" {
    command = "az vm extension set --publisher Microsoft.Azure.ActiveDirectory --name AADLoginForWindows --resource-group ${data.azurerm_resource_group.RG.name} --vm-name ${var.prefix}"
  }

The machine is up and running and the extension installed successfully. enter image description here

I've also assigned the appropriate role with users and groups in order to log in that VM with AAD authentication. enter image description here

And ensured that my VMs network configuration permits outbound access over TCP port 443.

However, when trying to log in the VM with RDP and my AAD user (associated with the role) I get the error "The logon attempt failed" as shown above.

enter image description here

I'm trying to RDP Windows 10 VM from Windows 10 Pro VM. enter image description here

My Windows 10 Pro VM is joined to Azure AD (with my AAD user). enter image description here

Yet, I get this error when RDP to the other Windows VM from my main Win10Pro VM. When trying to login Linux VMs with AAD authentication everything works as expected.

Running the command "dsregcmd /status" from the Win10Pro VM gave the above output: enter image description here

Also tried to RDP with "AzureAD\Username@Domain" but git the same credentials error.

What can be the problem? Thanks for the help :)

azure-virtual-machine azure-active-directory terraform-provider-azure azure
2 Answers

For the error, you could verify that the Windows 10 PC you are using to initiate the remote desktop connection is one that is either Azure AD joined, or hybrid Azure AD joined to the same Azure AD directory where your VM is joined to. For more information, see the document.

Please note that

Remote connection to VMs joined to Azure AD is only allowed from Windows 10 PCs that are Azure AD joined or hybrid Azure AD joined to the same directory as the VM. Additionally, to RDP using Azure AD credentials, the user must belong to one of the two RBAC roles, Virtual Machine Administrator Login or Virtual Machine User Login.

user_98333140

Solved, I had to configure both the Windows10Pro which I RDP from and the Windows10Pro which I RDP to be joined to Azure AD with my AAD user. Only when I joined both VMs to AAD with my AAD user I could RDP with that user.

So in case of authenticating using AAD credentials to Windows VM some steps should be considered:

  1. The machine which we RDP from should be Windows 10.

  2. The machine which we RDP to should be Windows 10.

  3. AADLoginForWindows extension should be installed on the remote VM. enter image description here

  4. Login roles should be assigned with the AAD user/ group to the remote VM. enter image description here

  5. Both machines should be Azure AD Joined or hybrid Azure AD joined.

user_33824780
Related