Signing into Azure joined virtual machine from any device

Up until recently, Azure AD login to virtual machines was severely limited, because your device had to be joined to the same Azure AD as the virtual machine. For many, this was fine, but with external consultants this soon becomes cumbersome.

However, this is no longer the case, and you can actually sign in with any user in the same tenant as the virtual machine (No B2B currently). Let me show you how!

What I find interesting is that there was an update to the documentation back in March 2023, that added details about passwordless authentication into VMs. However, there is no real requirement for passwordless here at all, but it is nice that it works.

Summary of requirements is as follows:

First we need our Azure windows virtual machine deployed, with this checkbox enabled:

After deployment of the VM, we should see this extension being added:

Second, we will copy the IP-address of the virtual machine, adding it to our hosts file (because I am lazy, and I have not configured a DNS suffix for my computer):

This is important, as if you try signing into the virtual machine with the FQDN, you’ll receive an error like this:

Third, we must assign our user (named MariusLocal) the Azure RBAC role Virtual Machine Administrator Login:

That’s it, we can now sign into our virtual machine using the below steps. Personally I am doing this from a computer Azure AD registered in a completely different tenant than the virtual machine.

  1. Start your remote desktop client
  2. Go to Advanced and enable Use a web account to sign in to the remote computer
  1. Go to General and type hostname only

Sign in using regular Azure AD sign-in. Conditional access policies will be applied, and passwordless options are available.

So, that’s it, this is way better than it has even been! 🙂

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s