Resolving MFA-Related RDP Issues To Azure VMs

Common MFA-Related Error Messages

You might see this error when attempting to initiate an RDP session to your Azure VMs:

“The sign-in method you’re trying to use isn’t allowed. Try a different sign-in method or contact your system administrator.”

Cause: This issue is frequently triggered by a Conditional Access policy that forces MFA for all users. If Conditional Access Policies are not in use, the problem could stem from the Security Defaults or legacy per-user MFA settings (enabled/enforced). Additionally, it might occur if the initiating Windows 11 computer is not utilizing a strong authentication method, such as Windows Hello.

Solution: Make sure all your devices use a strong authentication method, like Windows Hello, for sign-in. This is important to comply with Conditional Access policies that require robust authentication to access resources. Upgrading to a strong authentication method helps ensure your system’s security and allows secure RDP access to your Azure VMs without compromising your security posture (more to that later).

 

---

 

Another common error is:

“Your credentials did not work.” or “The logon attempt failed”

Cause: This error can occur if you have configured a legacy per-user Enabled/Enforced Microsoft Entra multifactor authentication or the Security Defaults are active.

Solution: Remove the legacy per-user MFA setting or disable the Security Defaults. You can find detailed steps on how to do this in the Microsoft documentation: Disable or Enable per-user Microsoft Entra multifactor authentication to secure sign-in events, Providing a default level of security in Microsoft Entra ID – Microsoft Entra | Microsoft Learn.

Transitioning to Conditional Access-based MFA settings is recommended for a more flexible and scalable authentication setup. Always know the risk when transitioning in a productive environment!

Alternative Solutions

If deploying Windows Hello for Business is not feasible, you can configure a Conditional Access policy that excludes the Microsoft Azure Windows Virtual Machine Sign-in app from the MFA requirements. This helps in bypassing MFA for VM sign-ins while maintaining security for other applications.

Steps to Exclude the VM Sign-In App:

1. Sign in to the Microsoft Entra Admin Center: Ensure you have sufficient administrative permissions, such as a Conditional Access Administrator or Security Administrator.
2. Navigate to Conditional Access: Go to Security → Conditional Access.
3. Create a new policy or edit an existing policy: Click on “New policy” or edit an existing policy and configure the policy to exclude the Microsoft Azure Windows Virtual Machine Sign-in app.
4. Exclude the app: In the cloud apps or actions section, include all apps except the Microsoft Azure Windows Virtual Machine Sign-in app.
5. Apply policy: Save and apply the new policy. Ensure to test it thoroughly to confirm it doesn’t inadvertently allow unintended access.

NOTE: If the Microsoft Azure Windows Virtual Machine Sign-in application is missing from Conditional Access, try this guide: Missing application

Implementing Windows Hello For Business

For a more secure and hassle free authentication experience, consider implementing Windows Hello for Business, which supports PIN and biometric authentication over RDP. Windows Hello for Business is supported from Windows 10 version 1809 and utilizes either certificate trust or key trust models for authentication.

Benefits:

• Secure authentication: Provides a more secure alternative to traditional password-based authentication.
• Convenient user experience: Simplifies the sign-in process for users.
• Compliance with security policies: Ensures compliance with organizational security policies.

Getting Started:

• Learn more about Windows Hello for Business: Windows Hello for Business – Overview | Microsoft Learn
• Configure Windows Hello for Business for your organization: Windows Hello for Business: Enhanced Security with Multi-Factor Unlock – cloudcoffee.ch

Conclusion

Navigating the complexities of MFA for Azure VM sign-ins can be challenging, but with the right configurations and understanding of Conditional Access policies, you can ensure seamless and secure access. Prioritizing the use of strong authentication methods like Windows Hello, and adjusting your Conditional Access policies if needed, will provide robust security without compromising on access.

Additional Resources

Learn more about how to sign in to a Windows virtual machine in Azure by using Microsoft Entra ID – Enhancing Security for Azure VMs with Entra ID-Based Authentication