Some AzureAD accounts will not authinicate

[adsi4nt]

Existing documentation URL(s)

https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser/#known-limitations

What changes are you suggesting?

Not all Azure Domain joined devices will allow a connection.

Additional information

I was able to get RDP over webpage to work only after creating a local user. My AzureAD account would not connect (Your Credentials were rejected.). However, when connecting via RDP on the local network IP address I was able to connect just fine. So it isn't the password.
I tried UPN (email) & azuread\email with no success.
I created a local user and was able to get right in.
Not sure where the issue is, but I blame Microsoft and Hello ;)

[Michael9127]

We are in the process of testing a fix for this issue, should be released soon! Will comment here as soon as its ready.

[Michael9127]

Hey @adsi4nt, we released an improvement that should allow you to connect to AzureAD domains now. We still need to tweak the domain handling for logging in with UPN format, but you can give it a go in the meanwhile if you'd like!

Now, when logging in with a username thats prepended with AzureAD, you will skip NLA/CredSSP and instead be prompted to provide a password in winlogon. You might need to re-add "AzureAD" to the front of your username in winlogon if you experience issues authenticating.

Also, please not that you will need to have NLA enforcement disabled on the RDP server for AzureAD logins with Browser-based RDP. This is now detailed here: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser/#known-limitations

We should have another release to improve any edge-cases soon, but let us know how it goes!

[adsi4nt]

Yes, it is working now. I did have to add the azuread\email again on the winlogin screen. Great job team!! Randy

…

________________________________ From: Mike ***@***.***> Sent: Friday, August 8, 2025 4:50 PM To: cloudflare/cloudflare-docs ***@***.***> Cc: Randy Hinders ***@***.***>; Mention ***@***.***> Subject: Re: [cloudflare/cloudflare-docs] Some AzureAD accounts will not authinicate (Issue #23991) [https://avatars.githubusercontent.com/u/23127753?s=20&v=4]Michael9127 left a comment (cloudflare/cloudflare-docs#23991)<#23991 (comment)> Hey @adsi4nt<https://github.com/adsi4nt>, we released an improvement that should allow you to connect to AzureAD domains now. We still need to tweak the domain handling for logging in with UPN format, but you can give it a go in the meanwhile if you'd like! Now, when logging in with a username thats prepended with AzureAD, you will skip NLA/CredSSP and instead be prompted to provide a password in winlogon. You might need to re-add "AzureAD" to the front of your username in winlogon if you experience issues authenticating. Also, please not that you will need to have NLA enforcement disabled on the RDP server for AzureAD logins with Browser-based RDP. This is now detailed here: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/rdp/rdp-browser/#known-limitations We should have another release to improve any edge-cases soon, but let us know how it goes! — Reply to this email directly, view it on GitHub<#23991 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AJLDQJ2V3UGH2IZYYXVTL7T3MUERJAVCNFSM6AAAAACCNYR3W2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTCNRZGI2TCNRXGY>. You are receiving this because you were mentioned.Message ID: ***@***.***>