Tag: security

If your environment does not have a directory service such as Active Directory Domain Services (ADDS). But you still require Microsoft Windows-based virtual machines (VMs) in Azure. Then you can integrate those VMs with Microsoft Entra ID for authentication purposes.

This allows users to sign-in to Azure Windows Server VMs using their Entra ID credentials. Whilst removing the dependency on locally managed user accounts. From a security perspective, this provides several benefits, including centralised identity management and improved auditing.

Prerequisites

To ne able to enable Entra ID authentication on a Windows VM the AADLoginForWindows extension must be installed.

This extension can be deployed in several ways:

• Using Azure CLI or Azure PowerShell

• During VM creation in the Azure portal

• Retrospectively through the Azure portal

Installing the extension during creation of an Azure VM:

When creating a VM in the Azure portal, the extension can be installed automatically, by selecting the Login with Microsoft Entra ID checkbox during the deployment process.

Installing the extension on a pre-existing Azure VM:

If the VM already exists, the extension can be installed manually:

1. Navigate to the VM in the Azure portal
2. Select Extensions + applications
3. Add the AADLoginForWindows extension

Once installed successfully, the extension will appear in the Extensions & applications blade, with a status of Provisioning succeeded.

Please note at the time of writing, this extension does not support automatic upgrades and requires manual updates when newer versions are released by Microsoft, this is shown in the example above by comparing the version and latest version columns.

Granting Access via Azure RBAC

Now the extension is installed, all you need to do for this to work is to grant your users the required Azure roles, however the role required depends on what permission levels your user requires.

Two Azure roles exist for this purpose Virtual Machine User Login & Virtual Machine Administrator Login. As the names of the roles suggest, the first role provides users accounts with standard user permissions, and the second role provides the user with local administrator permissions.

In a standard environment the above should be all you need to do to allow Entra ID authentication on an Azure VM. However in tenants with more complexity, you may find you need to complete some further troubleshooting and make some additional changes, especially if your tenant is leveraging Microsoft’s conditional access.

Conditional Access & MFA considerations

If you have a conditional access (CA) policy which enforces MFA, your users will need to authenticate with a strong modern authentication option, such as Windows Hello for Business.

If a strong modern authentication option is not possible in your environment, you will need to ensure the conditional access policy which enforces MFA does not do so, this can be done by excluding the Microsoft Azure Windows Virtual Machine Sign-in application in the cloud apps exclusion list in the CA policy.

I’ve also found the legacy per-user multifactor authentication settings (if enabled) also interfere with this authentication flow, to resolve this you need to disable this for each user in the Entra ID portal, the settings captured below are available by selecting the Per-User MFA option in the users blade available within the Entra ID portal:

Additional caveats and common gotchas:

• To be able to use modern authentication methods such as Windows Hello for Business, the Use a web account to sign in to the remote computer option, needs to be selected within the RDP client to work successfully:

The above setting can of course be saved to an RDP file to ensure this setting does not need to be enabled each time. You can also download a pre-prepared RDP file by using the connect option from the VMs properties in the Azure portal.

• The device the user is signing in from needs to be either an Entra ID Joined, Entra ID Hybrid Joined or Entra ID registered device. Otherwise, you’ll see sign-in errors at the RDP sign-in prompt, likely to be a generic error saying The logon attempt failed.

• When authenticating from a device which is Entra ID registered, every time a user authenticates with the RDP client they will need to specify the “AzureAD\” prefix, for example “AzureAD\username”.

• This authentication method is unsupported, if you are logging in from another Windows Server, and your tenant has a conditional access policy which enforces access only from compliant devices.
• To allow Microsoft Entra authentication to work on a Virtual Machine in Azure, the following networking requirements apply:
  • The Azure network needs to allow outbound access on TCP / 443 to the following Azure Global URLs (these URLs are different for Azure Government and Azure China clouds):
    • https://enterpriseregistration.windows.net – used for device registration
    • http://169.254.169.254 – Azure instance metadata service endpoint.
    • https://login.microsoftonline.com – used for authentication flows to Entra ID.
    • https://pas.windows.net – used for Azure role based access control (RBAC) authentication flows.

Hope this helps and thanks for reading!