Hi All, I am trying to explore the azure virtual desktop with azuread joined in it (not azure AD DS). here are the steps I have followed created virtual desktop pool with one windows 10 vm in it. granted virtual machine user login , desktop virtualization user role assigned to the workspace and application group. I have also assigned this vm to my user in hostpool assig option. from bastion host, I can see from about pc This vm is joined to AzureAD. when I try to login from following link, (cred passed are Username- AzureAD\username @keyman .com password-working password) I am getting this error "Oops, we couldn't connect to "SessionDesktop" Sign in failed. Please check your username and password and try again." https://rdweb.wvd.microsoft.com/arm/webclient/index.html we have conditional access MFA is enabled. I have gone through multiple documents, various troubleshooting forums , but still not getting any solution. can you please advise what I should check to make this work. thanks in advance.

Have you completed all of the steps outlined here: https://learn.microsoft.com/en-us/azure/virtual-desktop/deploy-azure-ad-joined-vm#assign-user-access-to-host-pools Also, this section is very important. Make sure you have everything in place as below:

azuread login issues with azure virtual desktop

khsarvaiya 6

Hi All,

I am trying to explore the azure virtual desktop with azuread joined in it (not azure AD DS).
here are the steps I have followed

created virtual desktop pool with one windows 10 vm in it.
granted virtual machine user login , desktop virtualization user role assigned to the workspace and application group.
I have also assigned this vm to my user in hostpool assig option.
from bastion host, I can see from about pc This vm is joined to AzureAD.
when I try to login from following link, (cred passed are Username- AzureAD\username@keyman .com password-working password) I am getting this error "Oops, we couldn't connect to "SessionDesktop"
Sign in failed. Please check your username and password and try again."
https://rdweb.wvd.microsoft.com/arm/webclient/index.html
we have conditional access MFA is enabled.

I have gone through multiple documents, various troubleshooting forums , but still not getting any solution. can you please advise what I should check to make this work.

thanks in advance.

JamesTran-MSFT 36,366 Reputation points Microsoft Employee

2021-12-09T23:30:09.913+00:00

khsarvaiya-6096
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

1 answer

Alan Kinane 16,786 Reputation points MVP

2021-11-26T09:26:15.66+00:00

Have you completed all of the steps outlined here: https://learn.microsoft.com/en-us/azure/virtual-desktop/deploy-azure-ad-joined-vm#assign-user-access-to-host-pools

Also, this section is very important. Make sure you have everything in place as below:
Please sign in to rate this answer.

1 person found this answer helpful.
khsarvaiya 6 Reputation points

2021-11-26T13:21:09.307+00:00

thanks @Alan Kinane for reply. appreciate it.

yes I have gone though this link as well.

yes I have assigned "Virtual Machine User Login" role to that VM and resource group both.

in host-pool ->RDP properties-> advance I have also added targetisaadjoined:i:1

in host-pool I have assigned username@keyman .com to this VM.

then I tried with "azuread\username@keyman .com" , "AzureAD\username@keyman .com" , "username@keyman .com"
but it is not working and shows same error.

Alan Kinane 16,786 Reputation points MVP

2021-11-26T13:29:20.947+00:00

Sorry for asking, but you mentioned you have MFA enabled. So have you performed these steps also?

If possible, maybe temporarily disable MFA for this account so MFA can be ruled out as an issue.

Also, have you rebooted the session host(s) since adding the RDP property: targetisaadjoined:i:1

khsarvaiya 6 Reputation points

2021-11-26T14:28:40.63+00:00

thanks @Alan Kinane for the immediate response on this, really appreciate it.

yes I have rebooted that vm.

for MFA, I understood that we can use MFA in this setup, so we dint disturb that for this setup.
But for disabling the MFA, I would need to check with our org admin. as this is applied to all org users and to check its impact.

I will check and update.

thanks.

Alan Kinane 16,786 Reputation points MVP

2021-11-26T14:52:18.697+00:00

You can still use MFA but you will need to apply MFA through conditional access policies instead of through the Microsoft 365 per-user MFA system.

https://learn.microsoft.com/en-us/azure/virtual-desktop/deploy-azure-ad-joined-vm#enabling-mfa-for-azure-ad-joined-vms

khsarvaiya 6 Reputation points

2021-11-26T15:29:43.737+00:00

thanks,

I have just confirmed, we have per user MFA is disabled.

and MFA is enabled with conditional access only in our organization.

Alan Kinane 16,786 Reputation points MVP

2021-11-26T16:15:42.247+00:00

If you could it might be good to rule out MFA by taking the user out of the CA policy temporarily to test.
Another thing to check is that the PKU2U protocol is enabled on both your own local device and on the session host - see here: https://learn.microsoft.com/en-us/azure/architecture/example-scenario/wvd/azure-virtual-desktop-azure-active-directory-join#protocol-and-client-options

khsarvaiya 6 Reputation points

2021-12-03T08:11:54.623+00:00

thanks @Alan Kinane , we have excluded windows-vm sign-in from the CA policy and now it started working.

JamesTran-MSFT 36,366 Reputation points Microsoft Employee

2021-12-06T17:29:22.397+00:00

@khsarvaiya
Thank you for following up on this and I'm glad that @Alan Kinane 's answers helped resolve your issue!

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
Sign in to comment