1
2
I have an Azure Active Directory (contosodev.net) with Azure Active Directory Domain Services. This directory is a separate directory from our main one (contoso.net). I can add external users as members or guests (such as david@contoso.net), but these users cannot RDP into a VM or authenticate with it, even if I am able to add them to the Remote Desktop Users group on the VM (e.g., it shows up as contosodev\david).
Is this possible? Or is it only possible for users on the actual domain to authenticate?
I have already changed the passwords after enabling the hash synchronization and the normal domain accounts work fine. I am asking because I have contractors that I would like to add under their gmail accounts, but let them RDP, otherwise I will create them actual domain accounts.
David Anderson
Posted 2018-05-25T12:33:17.633
Reputation: 111
2I’m a bit confused. I’m assuming you’re talking about a regular Windows VM that is domain joined to your on premise AD? I’m not aware of any situation where Azure AD is used to authenticate to a server like this. It’s just not what it’s used for and I don’t think that is possible. Azure AD is used for authenticating to Microsoft services and other web apps. – Appleoddity – 2018-05-25T12:43:06.413
This is not domain joined to a local AD, but an Azure AD using domain services. It's purely cloud-based (domain controllers are Microsoft managed and not a VM) – David Anderson – 2018-05-25T12:44:04.867
Please add more information about how the users are added and how they are supposed to access the VM. Comment also whether this procedure applies to you.
– harrymc – 2018-10-17T08:30:47.927@harrymc I’m not the OP but they are external users added as guests through the B2B invitation process. https://docs.microsoft.com/en-us/azure/active-directory/b2b/what-is-b2b
– GregGalloway – 2018-10-23T22:12:25.030I would really have liked to see a description of what happens during the connection and where and how exactly does the problem arrive. Maybe some Troubleshooting information as well. Without more data, you will need to find on our site someone that had solved the same problem in the same setup, which hasn't happened yet.
– harrymc – 2018-10-24T07:46:36.530@harrymc AADDS requires password hashes be synced to the cloud so it can verify your password is right. Passwords aren’t synced for external users so the login fails. – GregGalloway – 2018-10-25T01:06:33.413
I'm still unclear about what you did. Did you follow this procedure?
– harrymc – 2018-10-25T11:23:24.407@harrymc yes that’s how we did B2B invitations – GregGalloway – 2018-10-30T11:56:32.987