Strange issue of credential invalid

The behavior matches known Microsoft Entra ID sign-in limitations and requirements for RDP/AVD when using Entra accounts.

Check and fix the following in order:

1. Verify required Azure role assignment

• For every VM (including AVD session hosts and the standalone Azure VM), the Entra user must have Virtual Machine User Login or Virtual Machine Administrator Login assigned via Azure RBAC at the VM, resource group, or subscription scope.
• The error message
  • “Your account is configured to prevent you from using this device” directly indicates missing VM login role.
• Re-check that the role is assigned to the correct user or group in the same tenant as the VM.

2. Ensure the client device is correctly joined/registered For RDP/AVD sign-in with Entra credentials:

• The client device must be:
  • Microsoft Entra joined or Microsoft Entra hybrid joined to the same Entra tenant as the VM/session host, or
  • Microsoft Entra registered (in which case a special username format is required).
• On the client, run:
  • dsregcmd /status and confirm:
    • AzureAdJoined : YES (or AzureAdDeviceId present if registered)
    • AzureAdPrt : YES for SSO state.

3. Use the correct username format when RDP’ing

• If the client is Entra registered (not joined/hybrid joined), RDP must use:
  • AzureAD\******@contoso.com
• If the client is Entra joined/hybrid joined to the same tenant, normal UPN usually works, but using AzureAD\******@contoso.com is still valid.
• If the wrong format is used, Windows will show “Your credentials didn’t work” even though the account and password are correct.

4. Confirm the AADLoginForWindows extension is present

• For Entra sign-in to Azure VMs and AVD session hosts, the AADLoginForWindows extension must be installed and not removed.
• If it was uninstalled after the Entra join, reinstall it and test again.

5. Check MFA / Conditional Access configuration

• VM sign-ins do not support per-user enabled/enforced MFA.
• If the user has legacy per-user MFA enabled, RDP sign-in will fail with “Your credentials didn’t work” or “The sign-in method you’re trying to use isn’t allowed”.
• Fix:
  • Remove per-user MFA and instead use Conditional Access as described in Enforce Microsoft Entra multifactor authentication for Azure Virtual Desktop using Conditional Access.
  • If Conditional Access requires MFA, ensure the client uses Windows Hello for Business or exclude the Microsoft Azure Windows Virtual Machine Sign-in app from that policy.

6. Enable PKU2U on client and session hosts For AVD Windows Desktop client and direct RDP with Entra accounts:

• Ensure the security policy Network security: Allow PKU2U authentication requests to this computer to use online identities is enabled on both:
  • The local PC (client)
  • Each session host / Azure VM
• If PKU2U is disabled, Entra-based RDP authentication can fail with generic credential errors.

7. Confirm no temporary password and password validity

• If the Entra account has a temporary password or requires password change, RDP sign-in will fail.
• Test by signing into a web app (for example, Azure portal) in a private browser session; if prompted to change password, complete that first, then retry RDP/AVD.

8. Check logs for precise cause

• On the VM/session host, open Event Viewer → Applications and Services Logs → Microsoft → Windows → AAD → Operational and review events for the failed RDP attempts.
• This will show whether the failure is due to unauthorized client, missing role, MFA, or device state.

Once the above are aligned for both the AVD session hosts and the standalone Azure VM (correct RBAC role, correct device join/registration, correct username format, PKU2U enabled, no per-user MFA, AADLoginForWindows present), Entra ID credentials should work consistently at the second logon prompt.

References:

• Troubleshoot connections to Microsoft Entra joined VMs
• Sign in to Windows virtual machine in Azure using Microsoft Entra ID and Azure Roles Based Access Control
• Troubleshoot Remote Desktop connections to an Azure virtual machine
• Sign in to an Azure Arc-enabled server using Microsoft Entra ID and Azure Roles Based Access Control
• Supported identities and authentication methods