Add AAD login after creating an Azure VM
If you've deployed an Azure VM and did not enable the “Login with AAD credentials”, option, you can enable sign in using Azure Active Directory credentials later using Cloud Shell with this command in Azure CLI:
az vm extension set \
--publisher Microsoft.Azure.ActiveDirectory \
--name AADLoginForWindows \
--resource-group ResourceGroup \
--vm-name VMName
After running that command, you'll need to add an entry to the local group to allow interactive sign in using RDP. The extension doesn't add this permission and you will need to do it manually, running this command in a remote Powershell:
net localgroup "remote desktop users" /add "AzureAD\user@domain.com"
You will also need to add 2 lines the RDP file downloaded from the “Connect” tab so that you can connect without issues:
enablecredsspsupport:i:0
authentication level:i:2
After connecting to the VM using RDP, you will also need to disable network-level authentication from Control Panel.
In the background, the extension will change the Join Type of the VM to “Azure AD Joined” and your Devices blade will update with that information after a couple of minutes.
No need to re-create the VM.
Just putting this here for my notes.
