AzureAD user can not login to RDP on Windows 11Pro

Hello Erik Golias

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

1. Is the device Azure AD (Entra ID) joined, and does the account used for RDP have the correct format (such as AzureAD******@domain.com or ******@domain.com)? - https://learn.microsoft.com/en-us/windows/client-management/client-tools/connect-to-remote-aadj-pc
2. Has the Azure AD user been added to the local “Remote Desktop Users” group or provided the necessary VM login role (such as “Virtual Machine Administrator Login” or “Virtual Machine User Login”)?
3. What is the exact error message displayed during the failed RDP login attempt (“credentials did not work,” “logon attempt failed,” etc.) ?

Regards

Himanshu

Hi Himanshu

My Windows11 Pro PC is connected to AzureAD

I can Login to PC with my azureAD email ******@......com and PIN which I created on setup.

I have user AzureAD\iPads in my Remote Desktop Users list

When I try to RDP to PC it is asking for User and Password and can not pass this screen. I'm entering my AzureAD\iPads user password.

This is what I get.

I can not login to RDP.

Hello @Erik Golias IP address can't be used with Use a web account to sign in to the remote computer option. The name must match the hostname of the remote device in Microsoft Entra ID and be network addressable, resolving to the IP address of the remote device.

https://learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-windows?pivots=identity-extension-vm#sign-in-by-using-microsoft-entra-credentials-to-a-windows-vm

There're ways to resolve the issue:

Modify the HOSTS entry on client machine, add an A DNS record which pointing the correct device name (confirm from AAD Device record) to the IP of target machine. Use that device name in mstsc.

1. Check if the target machine is managed and if the hostname is set through Group Policy or MDM via the [DNS Client PrimaryDnsSuffix value] If this is set and is incorrect, it needs to be removed or set correctly. The dsreg client gives precedence to this value compared to the value set. https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-dnsclient#dns_primarydnssuffix
2. When customer requires to use FQDN to connect but AAD Device name is a short name, login to the target machine via local admin, add a “Primary DNS Suffix” for their domain suffix. Detailed instructions: Navigate to Advanced System Settings/System Properties -> Computer Name tab -> Click the "Change" button to rename the computer -> Click "More..." under the existing computer name -> Type in your domain name and click OK -> Save and reboot. Once it’s done, we can RDP with FQDN directly and no need to modify the HOSTS entry.

   Note: In such case, when Primary DNS Suffix is added, the Device-Sync scheduled task will be triggered which adding the FQDN into AAD device "hostnames" attributes. This is why it will resolve the issue.

Please let us know if you need more assistance. Thanks

Hi.

I’m connecting to PC in my office from home. I will VPN to office network and after I will RDP to my office pc. I can ping IP of office pc but I can not connect to pc with PC’s name.

PC name is WS04-ErikPres

how can I RDP to it?

Hello @Erik Golias

I understand that You’re trying to RDP into a Windows 11 Pro machine that is Entra joined, but the credentials fail even though you can log in locally with a PIN.

1. The PC is connected to Entra ID
2. You have AzureAD\iPads in the Remote Desktop Users group.
3. RDP prompts for username/password, not PIN.
4. Error says: Remote machine is AAD joined. Try using your work email address

As per the screenshot, we might suspect that this might happen due to the MFA related error.

If you configure a legacy per-user Enabled/Enforced Microsoft Entra multifactor authentication setting and you see the error, you can resolve the problem by removing the per-user MFA setting. For more information, see the article Enable per-user Microsoft Entra multifactor authentication to secure sign-in events.

Kindly refer the below document for the reference: https://learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-windows?pivots=identity-extension-vm#mfa-sign-in-method-required

Please let us know if this helps or need more assitance.