Some of my users cannot login to Azure Virtual Desktop

Question

Some of my users cannot login to Azure Virtual Desktop

Barry Tresadern 1

I have created a host pool with 6 personally assigned virtual machines. Two of the users are reporting that they cannot connect to the VM, they get a response that states their credentials did not work. All 6 users are in the same group and they can access other resources using these credentials. I've been through the troubleshooting steps but cannot determine why these two users are having this problem. Any thoughts?

Anonymous

2025-12-18T17:35:23.1466667+00:00

Hi Barry Tresadern

Thank you for reaching out to Microsoft Q&A. To better understand and isolate the issue, could you please provide the following details:

1.Are the affected users assigned to personally assigned session hosts, and can you confirm the exact VM name mapped to each user?

2.Were these users ever able to log in successfully to this host pool before, or is this their first login attempt?

3.Can the affected users sign in directly to their assigned VM (via Bastion or standard RDP) using the same credentials?

4.Are these users added to the Remote Desktop Users or Local Administrators group on the session host?

5.Are the session host and users are Microsoft Entra ID joined or Hybrid joined?

6.Do Microsoft Entra ID sign-in logs show successful authentication attempts for these users?

7.What is the exact error message displayed when the users attempt to connect via AVD or RDP?

8.Do the affected users have the Virtual Machine User Login role assigned on their specific VM or at the resource group level? (VM > Access control (IAM) > Role assignments)

9.Are the users assigned to the host pool’s Application Group? (Host pool > Application groups > Assignments tab)

Additionally, could you please check the private message and provide necessary details.
Barry Tresadern 1 Reputation point

2025-12-18T17:50:18.8966667+00:00
Thanks Jilakara, I've raised the support request, case number 2512180050003418 .

To try and answer your questions:

Yes, the users are mapped personally to their own session hosts. The VM names of the

No, they have never connected as yet.

Only managed to check with the user of QVD-PersINC-0, he has confirmed that he can make a connection using Bastion, but not using the Windows App

Yes they are added to remote desktop users group

I believe EntraID joined. We do not run any on-prem domain joined equipment. So the users have an Azure AD Entra user account and the VM's are joined to that same Azure AD

Yes there are successful login logs for these two users, they are accessing other services (such as Outlook / Teams and Azure SQL) without issue.

I've added a screenshot of the error the user sees on the support ticket.

Yes, assigned at the resource group to the user group that this team all belong to.

Yes, all users present and showing 1 assigned VM each.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-18T18:39:17.49+00:00
Hello Barry Tresadern,

Can you confirm if the users have the required Virtual Machine User Login role on the session host, this role is necessary for AVD authentication. In some cases, administrators may also need the Virtual Machine Administrator Login role for elevated access.

Assign the required role(s) to the user on the VM resource (session host).

Steps:

Go to Azure Portal → Virtual Machines → [Your VM] → Access control (IAM).

Click Add role assignment.

Select one of the following roles based on the requirement:

Virtual Machine User Login (for standard user access)

Virtual Machine Administrator Login (for admin-level access)

Assign the role to the user.

After assigning the appropriate role, the user will be able to log in successfully.

Built-in Azure RBAC roles Azure Virtual Desktop - Azure Virtual Desktop | Microsoft Learn

Let me know if any further queries - feel free to reach out!
Barry Tresadern 1 Reputation point

2025-12-18T19:09:35.7266667+00:00

The group of users (all 6 belong to it) already have the Virtual Machine User Login IAM granted at the resource group level.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-18T20:01:10.18+00:00

~~Barry Tresadern,~~
Barry Tresadern 1 Reputation point

2025-12-19T08:54:39.4+00:00

Hi, one of the users has reported back this morning, they can log in via Bastion, but not via the Windows app. The explanation regarding the user profile doesn't make a lot of sense to me, the other users have not had to log into Bastion first, nor do I see it as a requirement for an organisation to roll out AVD. Any idea what to check next?

Thanks
Barry
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-19T16:45:07.3366667+00:00

Hello Barry Tresadern,

Can you please confirm if the users have "per user MFA" enabled, which does not work with AVD?

Also Does your Conditional Access policy exclude multifactor authentication requirements for the Azure Windows VM sign-in cloud application?

Please refer: https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-desktop/troubleshoot-azure-ad-connections#the-user-name-or-password-is-incorrect
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-22T18:33:32.8733333+00:00

Hello Barry Tresadern, Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-23T19:43:13.9566667+00:00

Hello Barry Tresadern, Following up to see if the above provided information was helpful. If you have any further queries do let us know.Hello Barry Tresadern,
Barry Tresadern 0 Reputation points

2026-01-05T09:33:55.28+00:00

Hi Rukmini,

Apologies for the delay over the xmas period, I have been on leave.

So we do not currently have any conditional access policies defined in Entra and we do not enforce MFA on these users.

I understand from the team that all users are not able to access the AVD's via the Windows App currently.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-01-05T09:36:14.04+00:00

Barry Tresadern Please refer this similar issue https://learn.microsoft.com/en-us/answers/questions/5677074/login-issue-in-avd
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-01-06T13:30:44.9233333+00:00

Barry Tresadern Please refer this similar issue https://learn.microsoft.com/en-us/answers/questions/5677074/login-issue-in-avd did you get a change to check this case

Your answer

Anonymous

2025-12-18T17:35:23.1466667+00:00

Hi Barry Tresadern

Thank you for reaching out to Microsoft Q&A. To better understand and isolate the issue, could you please provide the following details:

1.Are the affected users assigned to personally assigned session hosts, and can you confirm the exact VM name mapped to each user?

2.Were these users ever able to log in successfully to this host pool before, or is this their first login attempt?

3.Can the affected users sign in directly to their assigned VM (via Bastion or standard RDP) using the same credentials?

4.Are these users added to the Remote Desktop Users or Local Administrators group on the session host?

5.Are the session host and users are Microsoft Entra ID joined or Hybrid joined?

6.Do Microsoft Entra ID sign-in logs show successful authentication attempts for these users?

7.What is the exact error message displayed when the users attempt to connect via AVD or RDP?

8.Do the affected users have the Virtual Machine User Login role assigned on their specific VM or at the resource group level? (VM > Access control (IAM) > Role assignments)

9.Are the users assigned to the host pool’s Application Group? (Host pool > Application groups > Assignments tab)

Additionally, could you please check the private message and provide necessary details.
Barry Tresadern 1 Reputation point

2025-12-18T17:50:18.8966667+00:00

Thanks Jilakara, I've raised the support request, case number 2512180050003418 .

To try and answer your questions:

Yes, the users are mapped personally to their own session hosts. The VM names of the

No, they have never connected as yet.

Only managed to check with the user of QVD-PersINC-0, he has confirmed that he can make a connection using Bastion, but not using the Windows App

Yes they are added to remote desktop users group

I believe EntraID joined. We do not run any on-prem domain joined equipment. So the users have an Azure AD Entra user account and the VM's are joined to that same Azure AD

Yes there are successful login logs for these two users, they are accessing other services (such as Outlook / Teams and Azure SQL) without issue.

I've added a screenshot of the error the user sees on the support ticket.

Yes, assigned at the resource group to the user group that this team all belong to.

Yes, all users present and showing 1 assigned VM each.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-18T18:39:17.49+00:00

Hello Barry Tresadern,

Can you confirm if the users have the required Virtual Machine User Login role on the session host, this role is necessary for AVD authentication. In some cases, administrators may also need the Virtual Machine Administrator Login role for elevated access.

Assign the required role(s) to the user on the VM resource (session host).

Steps:

Go to Azure Portal → Virtual Machines → [Your VM] → Access control (IAM).

Click Add role assignment.

Select one of the following roles based on the requirement:

Virtual Machine User Login (for standard user access)

Virtual Machine Administrator Login (for admin-level access)

Assign the role to the user.

After assigning the appropriate role, the user will be able to log in successfully.

Built-in Azure RBAC roles Azure Virtual Desktop - Azure Virtual Desktop | Microsoft Learn

Let me know if any further queries - feel free to reach out!
Barry Tresadern 1 Reputation point

2025-12-18T19:09:35.7266667+00:00

The group of users (all 6 belong to it) already have the Virtual Machine User Login IAM granted at the resource group level.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-18T20:01:10.18+00:00

~~Barry Tresadern,~~
Barry Tresadern 1 Reputation point

2025-12-19T08:54:39.4+00:00

Hi, one of the users has reported back this morning, they can log in via Bastion, but not via the Windows app. The explanation regarding the user profile doesn't make a lot of sense to me, the other users have not had to log into Bastion first, nor do I see it as a requirement for an organisation to roll out AVD. Any idea what to check next?

Thanks
Barry
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-19T16:45:07.3366667+00:00

Hello Barry Tresadern,

Can you please confirm if the users have "per user MFA" enabled, which does not work with AVD?

Also Does your Conditional Access policy exclude multifactor authentication requirements for the Azure Windows VM sign-in cloud application?

Please refer: https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-desktop/troubleshoot-azure-ad-connections#the-user-name-or-password-is-incorrect
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-22T18:33:32.8733333+00:00

Hello Barry Tresadern, Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-12-23T19:43:13.9566667+00:00

Hello Barry Tresadern, Following up to see if the above provided information was helpful. If you have any further queries do let us know.Hello Barry Tresadern,
Barry Tresadern 0 Reputation points

2026-01-05T09:33:55.28+00:00

Hi Rukmini,

Apologies for the delay over the xmas period, I have been on leave.

So we do not currently have any conditional access policies defined in Entra and we do not enforce MFA on these users.

I understand from the team that all users are not able to access the AVD's via the Windows App currently.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-01-05T09:36:14.04+00:00

Barry Tresadern Please refer this similar issue https://learn.microsoft.com/en-us/answers/questions/5677074/login-issue-in-avd
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-01-06T13:30:44.9233333+00:00

Barry Tresadern Please refer this similar issue https://learn.microsoft.com/en-us/answers/questions/5677074/login-issue-in-avd did you get a change to check this case