20

My organization is running Windows 10 joined to Azure AD organization (completely cloud hosted, i.e. no on-prem Active Directory). I login to my PC with a username in the form of "username@organization.com" with no issues and have enabled Remote Desktop connections to this PC.

If I attempt to Remote Desktop from another PC on the LAN or from home, my credentials are always deemed invalid. If I attempt to login using a local account (via RDP) it works just fine.

Can anyone suggest why Azure AD credentials do not work over RDP or how to enable this feature?

|improve this question
26

It is possible. Basically you have to ensure no authentication information is sent when connecting, forcing the login screen to appear.

To do this, you must create and edit an .rdp file.

  1. Open the Remote Desktop Connection window, enter the computer name or IP
  2. Save connection settings (Show options, Save as)
  3. Open the saved .rdp file in a text editor, and make sure these rows exist like this:
enablecredsspsupport:i:0
authentication level:i:2
  1. Load this into RDC (Open button)
  2. Connect, provide Azure AD credentials, enjoy!

Note: when setting up the computer accepting the connection make sure not to force Network Level Authentication (checkbox on the menu where you allow the remote connections).

Credits where it's due: morgansimonsenblog.azurewebsites.net

|improve this answer
  • 3
    One key omission here - you MUST login with the credentials as follows: AzureAD\<full UPN in Azure AD> – Graham Nov 9 '16 at 19:07
  • Awesome; been banging my head against the wall for hours. Thanks for this. – MSC Feb 20 '17 at 3:15
  • @Graham I'm not sure, I log in simply with my email (myname@company.com), the same as I would log in to eg. office.com; but thanks, some might need it that way. – vacip Mar 4 '17 at 23:26
  • 1
    It seems this is still the case for how this has to be done even with the Slow Windows Insider Ring as of June 7, 2017 when connecting from a Production Ring client (Creator's Update). When I first create the .RDP file, the authentication level:i:2 setting is there but the enablecredsspsupport setting needed to be added. With this setting, I can login with my Name@Email.com for the username and my password as you would expect. As a data point, my AAD is O365-based, in case that matters. – Jaxidian Jun 7 '17 at 19:37
  • This still works in 2019 ! – D3l_Gato Jul 14 at 13:37
0

This seems to be unsupported at the moment 8-(

"Remote desktop into an Azure AD Joined device is not supported at this time (by design)." https://social.technet.microsoft.com/Forums/en-US/05e1edd8-e22b-4865-8cb8-87673347f450/azure-ad-join-vs-rdp?forum=win10itprogeneral

See also: http://www.edugeek.net/forums/windows-10/157561-windows-10-azure-ad-joined-office-365-remote-desktop-connection-rdp.html

|improve this answer
  • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. – Ramhound Sep 1 '15 at 13:03

protected by Community♦ Feb 15 '16 at 9:44

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.