Unable to sign in to Microsoft Entra ID joined Windows 11 Azure VM using Entra ID user credentials

Mattias Lindholm 0 Reputation points
2026-10-12T06:53:09.5733333+00:00

Hello,

I have deployed a new Windows 11 Pro Azure Virtual Machine and successfully joined it to Microsoft Entra ID. The device is also enrolled into Intune.

Current environment:

Windows 11 Pro Azure Virtual Machine

Microsoft Entra ID Joined

Intune MDM enrollment active

Device visible in Intune

Local VM administrator account

Entra ID end-user account

End-user account added to the local Administrators group

Problem:

I am unable to log in interactively to the Windows 11 VM using the Entra ID end-user account.

I can only log in successfully using the local VM administrator account.

Observations:

dsregcmd /status shows:

AzureAdJoined = YES

DeviceAuthStatus = SUCCESS

MDM enrollment is active and configured for Intune

Device appears correctly in Intune

The Entra ID user has been added to the local Administrators group

runas /user:AzureAD<username> cmd succeeds, confirming that the Entra ID account can authenticate

The Entra ID account appears in local group membership

Interactive Windows sign-in with the Entra ID user fails

Login using the local VM administrator account works without issues

Expected result:

I expect to be able to sign in to the Windows 11 Azure Virtual Machine using Microsoft Entra ID user credentials in the same way as on a physical Microsoft Entra joined Windows 11 device.

Questions:

Are additional Azure VM settings required to enable interactive Entra ID sign-in?

Is the Microsoft Entra login VM extension required?

Are additional Azure RBAC roles required for VM sign-in?

Is there a difference between Microsoft Entra Join on an Azure VM and on a physical Windows 11 device regarding user logon?

Any guidance would be appreciated.

Thanks, Mattias

Windows for business | Windows Client for IT Pros | User experience | Remote desktop services and terminal services
0 comments
Answer accepted by question author
Rukshan edirisinghe 1,560 Reputation points
2026-10-12T08:33:36.62+00:00

Hi @Mattias Lindholm

Yes, Azure VMs work a bit differently here. On a physical device, Entra join is enough. On an Azure VM, Microsoft's supported path is the Microsoft Entra login VM extension plus Azure RBAC roles, and adding the Entra user to the local Administrators group is actually listed as not supported. That's why runas works but interactive sign-in doesn't.

To get it working:

  1. On the VM in the Azure portal, turn on the system-assigned managed identity (Identity blade). This has to happen before the extension.
  2. Install the AADLoginForWindows extension on the VM.
  3. In the VM's Access control (IAM), give the user either Virtual Machine Administrator Login (admin rights) or Virtual Machine User Login (standard user). Owner or Contributor on its own isn't enough to sign in.
  4. Connect with Remote Desktop Connection: under Advanced, tick "Use a web account to sign in to the remote computer". Use the VM's computer name rather than its IP, and sign in as ******@domain.com.

If your own PC is Entra joined to the same tenant, the classic RDP sign-in with AzureAD\******@domain.com works too.

Was the VM joined by hand from inside Windows, or through the extension when it was created?

If this resolved your issue, please consider accepting it as the answer. If sign-in still fails after the role is assigned, let me know and I'll be happy to keep helping.

Reference:

Was this answer helpful?

1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Mattias Lindholm 0 Reputation points
    2026-10-12T13:28:27.6933333+00:00

    Hello Rukshan,

    Thanks for your support. It really helped me move forward with this issue. 😊

    However, the problem still persists, although it now looks different.

    The Entra ID authentication flow completes successfully, including Microsoft Authenticator MFA approval, but then fails with the following error:

    Error Code: -895352830

    Request Id: 1048e7f3-5f88-4409-a135-70101f0a5600

    Correlation Id:

    69bd7016-1998-4e1e-a1e7-7759d40f0d00

    Timestamp:

    2026-10-12T13:07:35.361Z

    AADSTS293004:

    The target-device identifier in the request

    VM.swedencentral.cloudapp.azure.com

    was not found in the tenant.

    Trace ID:

    dafe9b8d-b599-4528-ab3b-bfc1b90c6f00

    The failure occurs after successful authentication and MFA approval, during the device validation stage.

    For reference, I have completed all the recommended steps:

    • Enabled the VM's System Assigned Managed Identity
    • Installed the Azure AD based Windows Login extension
    • Assigned the user the Virtual Machine Administrator Login role
    • Configured an Azure DNS name and connected using the DNS name instead of the IP address
    • Used the "Use a web account to sign in to the remote computer" option in Remote Desktop Connection

    If you have any further ideas on the next troubleshooting steps for this specific error, it would be very much appreciated. 🙂

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.