How to login Azure Ad User in Azure VM with bastion

Hello MIKA TANAKA, you can Sign in to Windows virtual machine in Azure using Microsoft Entra ID.

You need to assign one of the following Azure roles to determine who can sign in to the VM

• Virtual Machine Administrator Login: Users who have this role assigned can sign in to an Azure virtual machine with administrator privileges.

• Virtual Machine User Login: Users who have this role assigned can sign in to an Azure virtual machine with regular user privileges.

If you are creating a Windows VM through Azure portal, please make sure to enable the Microsoft Entra login option for the VM by following the below mentioned steps.

On the Management tab, select the Login with Microsoft Entra ID checkbox in the Microsoft Entra ID section.

Please refer to the below Screenshot for your reference.

Make sure that System assigned managed identity in the Identity section is selected. This action should happen automatically after you enable login with Microsoft Entra ID.

Note

If the legacy Per-user MFA is Enabled/Enforced for your user account, please make sure to disable the Per-User MFA by following the below mentioned steps.

To change the per-user Microsoft Entra multifactor authentication state for a user, complete the following steps:

Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.

1. Browse to Identity > Users > All users.
2. Select a user account, and then select Per-user MFA.
3. Search for the affected user and check the Per-user MFA status. If it is enabled, please select Disable MFA.

Finally, install the Microsoft Entra login VM extension to enable Microsoft Entra login for Windows VMs.

You can install the AADLoginForWindows extension on an existing Windows Server 2019 or Windows 10 1809 and later VM to enable it for Microsoft Entra authentication.

The following example uses the Azure CLI to install the extension:

az vm extension set --publisher Microsoft.Azure.ActiveDirectory --name AADLoginForWindows --resource-group myResourceGroup --vm-name myVM

Please refer this link for more detailed understanding- https://dori-uw-1.kuma-moon.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-windows?pivots=identity-extension-vm#sign-in-by-using-microsoft-entra-credentials-to-a-windows-vm

If you have any further queries, do let us know.

Steps for Windows VM

Enable Azure AD login extension

Go to your VM in Azure Portal → Extensions + applications → Add → AADLoginForWindows.

Assign RBAC role to Azure AD user

  VM → **Access Control (IAM)** → Add role assignment.
  
     Select **Virtual Machine User Login** (or Admin Login if elevated permissions required).
     
        Assign to the Azure AD user/group.
        
        **Use Bastion to log in**
        
           Navigate to VM → **Connect** → **Bastion**.
           
              Select **Azure AD authentication** option.
              
                 Enter your **Azure AD credentials**.
                 
                    Bastion will open the remote session (RDP in browser).
                    

Steps for Linux VM

1. Enable AAD login extension
   • Go to your VM → Extensions → Add → AADLoginForLinux.
2. Assign RBAC role
   • VM → Access Control (IAM) → Assign Virtual Machine User Login or Virtual Machine Administrator Login.
3. Use Bastion to log in
   • Navigate to VM → Connect → Bastion.
   • Choose SSH with Azure AD authentication.
   • Authenticate with your Azure AD account.
   • A session will open in the browser terminal.

Important Notes

• The Azure AD user must have MFA enabled if your tenant enforces it.
• Only supported OS versions allow Azure AD login via Bastion (Windows Server 2019+, certain Linux distros).
• If you don’t see the Azure AD authentication option in Bastion, ensure the login extension is properly installed and the VM is AAD-joined. Steps for Windows VM
  1. Enable Azure AD login extension
     • Go to your VM in Azure Portal → Extensions + applications → Add → AADLoginForWindows.
  2. Assign RBAC role to Azure AD user
     • VM → Access Control (IAM) → Add role assignment.
     • Select Virtual Machine User Login (or Admin Login if elevated permissions required).
     • Assign to the Azure AD user/group.
  3. Use Bastion to log in
     • Navigate to VM → Connect → Bastion.
     • Select Azure AD authentication option.
     • Enter your Azure AD credentials.
     • Bastion will open the remote session (RDP in browser).
  Steps for Linux VM
  1. Enable AAD login extension
     • Go to your VM → Extensions → Add → AADLoginForLinux.
  2. Assign RBAC role
     • VM → Access Control (IAM) → Assign Virtual Machine User Login or Virtual Machine Administrator Login.
  3. Use Bastion to log in
     • Navigate to VM → Connect → Bastion.
     • Choose SSH with Azure AD authentication.
     • Authenticate with your Azure AD account.
     • A session will open in the browser terminal.
  Important Notes
  • The Azure AD user must have MFA enabled if your tenant enforces it.
  • Only supported OS versions allow Azure AD login via Bastion (Windows Server 2019+, certain Linux distros).
  • If you don’t see the Azure AD authentication option in Bastion, ensure the login extension is properly installed and the VM is AAD-joined.

Hello Mika , welcome to MS Q&A

Why can’t I log in with an Azure AD user via Bastion?

Azure Bastion only supports local account authentication for RDP.

Even if the VM is Azure AD joined and the user has the Virtual Machine User Login role, Bastion will not accept Azure AD credentials.

Local admin works, Azure AD user login is not supported (as of now).

How to test Intune policies (e.g., AppLocker)

• Use direct RDP from a client machine that is:
  • Azure AD joined or hybrid joined to the same tenant.
  • Running Windows 10/11 (20H1+).
• Ensure the VM has the AADLoginForWindows extension installed.
• Assign Virtual Machine User Login role to the test user.
• Connect with: AzureAD\******@domain.com via RDP client. Why can’t I log in with an Azure AD user via Bastion?
  • Azure Bastion only supports local account authentication for RDP.
  • Even if the VM is Azure AD joined and the user has the Virtual Machine User Login role, Bastion will not accept Azure AD credentials.
  • Local admin works, Azure AD user login is not supported (as of now).

Please "Accept as Answer" if it helped so it can help others in community looking for help on similar topics.

Similar query -->https://dori-uw-1.kuma-moon.com/en-us/answers/questions/409639/enable-azure-ad-login-with-bastion-on-exisitng-vm