Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
MFA does not work to Entra ID VM login
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(230.39999999999998, 44%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETA%3C/text%3E%3C/svg%3E)
Talaiti AIHAIMAITI
20
Reputation points
Currently both local account Login and Entra ID work in bastioned enabled VM portal. As attached, created CA as anticipation of applying to EntraID VM Login, but has not worked so far even having tried almost all the scenarious.
Sign-in frequency : every time.
Microsoft Security | Microsoft Entra | Microsoft Entra ID
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 99%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
Rukmini 43,915 Reputation points Microsoft External Staff Moderator2026-04-28T05:14:16.8733333+00:00 Hello Talaiti AIHAIMAITI
<deleted>
-
Talaiti AIHAIMAITI 20 Reputation points
2026-04-28T05:57:15.81+00:00 My goal is to enforce MFA on Entra ID VM login, so why did you suggest to exclude "Microsoft Azure Windows Virtual Machine Sign-in etc." ? Besides, Per-user MFA : Already Disabled, and Security Defaults is as attached (There is no toggle).
-
Rukmini 43,915 Reputation points Microsoft External Staff Moderator
2026-04-28T07:40:51.3666667+00:00 Hello Talaiti AIHAIMAITI
Thank you for sharing the details will check internally and get back to you!
-
Rukmini 43,915 Reputation points Microsoft External Staff Moderator
2026-04-29T03:51:56.7833333+00:00 Hello Talaiti AIHAIMAITI
Because of the way the OS-level authentication flow operates, Conditional Access rules like MFA and sign-in frequency are not fully implemented while logging into a virtual machine (VM) using Microsoft Entra ID via Azure Bastion. This implies that even with properly specified policies, MFA might not activate.
MFA and strict Conditional Access policies are not currently supported for Entra ID-based VM login via Bastion, even if configured. This is a platform limitation, not a misconfiguration.
-
Rukmini 43,915 Reputation points Microsoft External Staff Moderator
2026-04-30T03:01:45.9966667+00:00 Hello Talaiti AIHAIMAITI
Following up to see if the above provided information was helpful. If you have any further queries do let us know.
-
Talaiti AIHAIMAITI 20 Reputation points
2026-05-04T07:16:31.29+00:00 Thank you for your response.
However, I checked the latest official Microsoft Learn documentation for Azure Bastion + Microsoft Entra ID authentication, and it states that MFA and Conditional Access policies are evaluated during the sign-in process.
https://learn.microsoft.com/en-us/azure/bastion/bastion-entra-id-authentication?utm_source=chatgpt.com&tabs=portal%2Cwindows%2Cportal-rdpOfficial reference: Azure Bastion – Configure Microsoft Entra ID authentication
Since our company is planning to migrate from local VM accounts to Microsoft Entra ID login, we need to confirm the supported MFA design before proceeding.
Thank you.
Sign in to comment
Sign in to answer