Entra Join a Windows Server 2019 in a Workgroup

Mark 50 Reputation points
2026-07-20T11:15:32.42+00:00

Hi

We have a number server (Windows Server 2019) that are hosted in Azure (Azure VMs) that are currently onpremised domain joined (Hybrid).

We have a requirement to transition these servers to Entra ID cloud native and decommission the onpremises domain. We have made a strat on a single server that is no longer business critical and have made the following changes in preperation:

  • Removed from domain and joined to a WorkGroup.
  • Added the Extension for Azure AD based Windows Login.
  • Added the Role Assignment for selected users (Virtual Machine Administrator Login).
  • Attempted RDP login using my Entra credentials (full UPN) and the related password, but the user account would not login.
  • Tried to use remote connection with RDP in Azure using local admin creds setup for Bastion and it logs in fine but a "dsregecm /status" indicates user and device is not AzureADjoined, which I sort of expected as I haven't performed a join task of such!
  • Attempted a "dsregcmd /join" and thios too doesn't seem to join the server to Entra.

Next steps I'm a little stuck on as I have read different requirements and unsure whether I'm performing the correct tasks as the server does not have an option to join School or Workplace via Accounts section in settings.

Can anyone please assist me to join the server to Entra so I can login to it using my Entra credentials? - Only the last thing we need is to have to rebuild every server to Server 2022 or later when it appears 2019 is supported!

Many thanks

MB

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-07-20T11:16:17.5433333+00:00

    Windows Server 2019 isn’t supported for Microsoft Entra sign-in to Azure Windows VMs in the provided documentation.

    What is supported:

    • Azure Windows VMs become Microsoft Entra joined after enabling the Microsoft Entra login capability and installing the AADLoginForWindows extension.
    • For Windows Server, the documented support for Microsoft Entra authentication is tied to newer server versions, and the Arc-based guidance explicitly calls out Windows Server 2025 or later for that scenario.
    • After this capability is enabled, the VM can’t also be joined to another domain. To join it to another domain later, the Microsoft Entra join extension must be removed.

    For the current Server 2019 VM, the supported checks are:

    1. Verify the AADLoginForWindows extension installed successfully by reviewing: C:\WindowsAzure\Logs\Plugins\Microsoft.Azure.ActiveDirectory.AADLoginForWindows\1.0.0.1\CommandExecution.log
    2. Verify the VM can reach the required Microsoft Entra endpoints and that the Azure Instance Metadata Service queries return valid VM, tenant, and token data.
    3. Confirm the sign-in role assignment is present:
      • Virtual Machine Administrator Login, or
      • Virtual Machine User Login
    4. For sign-in troubleshooting, run dsregcmd /status and check for:
      • AzureAdJoined : YES
      • AzureAdPrt : YES
    5. Review RDP sign-in events in: Applications and Services Logs\Microsoft\Windows\AAD\Operational

    Important limitations relevant to this scenario:

    • dsregcmd /join is not the documented method in the provided guidance for making an Azure VM Microsoft Entra joined for this feature; the join is tied to the VM login capability and extension deployment.
    • Bastion guidance in the provided Q&A indicates Azure AD user sign-in through Bastion isn’t supported; direct RDP is the path described for Microsoft Entra credential sign-in.
    • If the VM doesn’t become AzureAdJoined : YES after the extension is installed, check that the VM has a system-assigned managed identity enabled. A matching Q&A resolution identified that missing managed identity prevented the join from completing.

    Based on the provided documentation, there isn’t a supported path shown to make a Windows Server 2019 Azure VM cloud-native Microsoft Entra sign-in capable in the same way as the newer supported Windows Server versions. If Microsoft Entra sign-in is the requirement, the documented supported path is to use a supported Windows Server version rather than rely on manual dsregcmd /join on Server 2019.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.