How do i enable Entra authentication in bastion connection

Hello Suraj Kumar Kanth

I understand that you’re facing an issue where Azure Bastion doesn’t show the “Sign in with Microsoft Entra ID” option when trying to RDP into a VM, even though you’ve enabled Entra ID login during VM creation and configured the necessary device management settings under Entra ID.

Prerequisites Checklist for Entra ID Login via Bastion:

1. VM OS Version: Must be Windows Server 2019 Datacenter or later, or Windows 10/11 Enterprise/Pro, properly joined to Entra ID. The VM must support Entra ID-based login.
2. Azure Bastion Premium SKU Entra ID-based login requires Bastion standard SKU. If you’re using Basic, you won’t see the Entra ID sign-in option.
3. Ensure the Azure VM has Entra ID login enabled: Go to VM > Settings > Configuration > Entra ID. Confirm “Login with Entra ID” is enabled.
4. The Entra ID user you’re logging in with must have “Virtual Machine Administrator Login” or "Virtual Machine User Login" role on the VM or its resource group. Assign these via IAM: Goto VM >Access Control (IAM) > Add role assignment.
5. Ensure the VM is registered as a device in Entra ID: Go to Entra ID > Devices > All Devices and confirm the VM is listed. If not, the login won’t work properly.
6. The VM must allow Remote Desktop connections. Ensure port 3389 is allowed in the NSG, although Bastion usually handles this via tunneling.

Use Native RDP Client Instead of Bastion

1. If Bastion does not support Entra ID login, try using mstsc.exe (Windows Remote Desktop Client).
2. In Advanced settings, select "Use a web account to sign in to the remote computer".

Refer https://learn.microsoft.com/en-za/answers/questions/1438080/how-to-login-azure-vm-using-entra-id-credential-vi

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

@Sindhuja Dasari
thanks for the response, i am creating a Windows (Windows 11 Enterprise multi-session) VM , I have Baston standard SKU, and "Ensure the Azure VM has Entra ID login enabled: Go to VM > Settings > Configuration > Entra ID. Confirm “Login with Entra ID” is enabled." this option is not visible in the configuration panal of vm

Hello Suraj Kumar Kanth

Thank you for your response.
At this moment Azure Bastion can be used to log in with Microsoft Entra ID authentication using Azure CLI and the native RDP client mstsc.

The native client feature allows you to connect to your target VMs via Bastion using Azure CLI, and expands your sign-in options to include local SSH key pair and Microsoft Entra ID.

Refer https://learn.microsoft.com/en-us/answers/questions/1629043/does-azure-bastion-support-for-azure-active-direct

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

@Sindhuja Dasari i want to use portal in browser for connecting with vm through entra id as mac to not support rdp connection through cli. can you give some suggestion related to this where i get option to connect to vm via bation on browser using entra id

Hello Suraj Kumar Kanth

I understand that you want to connect VM bastion on browser.
At this time, you can use Azure Bastion to log in with Microsoft Entra authentication via the Azure CLI and the native RDP client mstsc, and couldn't connect via browser.