The message The sign-in method you’re trying to use isn’t allowed. Try a different sign-in method or contact your system administrator.
means an authentication policy rejected the method or account state you presented. A correct password can still fail. First identify whether the prompt came from Azure Virtual Desktop (AVD), native Azure VM RDP, Azure Bastion, or a local/domain Windows sign-in; each path has a different policy owner and fix.
This error is usually a policy decision, not proof that your password is wrong. In Azure services, Microsoft documents it most directly as a Conditional Access restriction. In other Entra-based RDP flows, the selected multifactor method, device state, account format, or temporary-password status can make an otherwise valid account unacceptable. On a physical Windows computer or a domain controller, Windows user-rights assignments can produce similar wording.
As an Amazon Associate I earn from qualifying purchases.
Identify where the error appears before changing anything
Write down the exact screen, the account you used, and whether the computer is personal, Entra joined, Entra registered, or domain joined. Use this map to choose the right branch:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Connection path | Typical prompt location | Primary control | Administrator scope |
|---|---|---|---|
| Azure Virtual Desktop | AVD client while opening a workspace or desktop | Microsoft Entra Conditional Access and, potentially, legacy per-user MFA | Tenant and AVD identity policy |
| Azure VM native RDP | Windows Remote Desktop client connecting directly to a VM | Entra authentication support, Conditional Access, device state, and credential format | Tenant, client device, and VM |
| Azure Bastion portal RDP | Azure portal’s Bastion connect workflow | Bastion/Windows support, Entra dependency reachability, and Conditional Access | Azure resource, VM network, and tenant |
| Local or domain Windows sign-in | Windows lock screen, sign-in screen, or a domain controller | Windows User Rights Assignment allow/deny policies | Local Security Policy or domain Group Policy |
Fix the error in Azure Virtual Desktop
Why AVD rejects a correct password
For AVD, the wording indicates that a Conditional Access policy is restricting access. A second common cause is enabling legacy per-user multifactor authentication for the same users while also applying Conditional Access to the Entra-joined session host. That combination can leave the user with no permitted sign-in method for the session.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Administrator procedure
- Confirm that the failed prompt is from an AVD workspace or desktop rather than a direct VM connection.
- In Microsoft Entra, review Conditional Access policies that target the relevant Azure Virtual Desktop or Windows Cloud Login resources. Check the assignments for the affected user, group, application, device platform, location, and authentication-strength requirements.
- Open the Entra sign-in log for the failed attempt. The Conditional Access tab identifies which policy applied and whether the result was failure, failure due to a grant control, or a policy exclusion.
- Check whether the user has legacy per-user MFA enabled. Microsoft’s guidance for this AVD scenario is to disable the per-user setting for affected users and enforce MFA through Conditional Access instead.
- After the policy change has propagated, have the user fully sign out of the AVD client, close it, start a new sign-in, and complete the method required by the active Conditional Access policy.
Do not solve an AVD Conditional Access failure by repeatedly changing the password. A password reset does not remove a policy restriction, and repeated attempts can create a separate account-lockout problem.
Fix direct Azure VM RDP sign-in
Check the authentication method and account state
Direct RDP to an Azure VM has additional Entra requirements. Conditional Access that requires MFA generally needs a supported strong method, such as Windows Hello for Business, in the documented Entra-joined RDP scenario. A temporary password cannot be used to sign in to a remote desktop connection, even if that password works for an interactive web sign-in or an initial account setup.
Use the documented account format
When the RDP client and VM meet the Microsoft Entra-registered scenario’s requirements, enter the user name as AzureADUPN, replacing UPN with the complete user principal name. Entering only the email-style UPN, a local-machine name, or an old domain prefix can select a different authentication path and produce the same rejection.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
RDP troubleshooting sequence
- Verify the client and target VM join state. A device that is merely registered, while the procedure requires an Entra-joined device, will not satisfy the same sign-in conditions.
- Confirm that the account is not using a temporary password. Complete the required password change through an interactive sign-in first, then use an authentication method supported for RDP.
- Determine whether the tenant’s Conditional Access policy requires MFA or a particular authentication strength. If the user can satisfy that requirement only with an unsupported method, the policy will deny RDP despite a correct password.
- Enter the account in the required
AzureADUPNform when that documented scenario applies. In the RDP client, choose the option that lets you use a different account rather than allowing a cached local credential to be reused. - Review the Entra sign-in log and the VM-side event information together. The Entra record tells you which policy or authentication requirement failed; the VM record helps distinguish an identity rejection from a later Windows logon-rights failure.
Fix Azure Bastion portal RDP sign-in
Bastion adds a browser and Azure resource layer between you and the VM. A failure in the portal can therefore reflect support, network, or Conditional Access conditions rather than the VM password.
Verify target and version support
Check that the target Windows VM and the Bastion deployment are on supported Windows and Bastion versions for the Entra RDP method you selected. Also confirm that the selected Bastion SKU and connection option support that authentication flow. If the portal offers several methods, do not assume that a method available in the interface is valid for every target configuration.
Check Entra dependency reachability
The VM must be able to reach the Entra dependencies required by the sign-in flow. Review the VM’s outbound network controls, DNS resolution, proxy rules, and firewall paths. A restricted network can prevent token or device checks and surface as a sign-in-method rejection rather than as a clear connectivity error.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use the sign-in log to separate policy from infrastructure
- Record the UTC time, user principal name, target VM, and Bastion resource.
- Open the corresponding Entra sign-in event and inspect the Conditional Access result. A policy failure points to tenant configuration; an event with no matching policy result makes target support or network reachability more likely.
- Validate the VM and Bastion support combination, then test again with the authentication method permitted by the tenant policy.
If the same account works for another Entra sign-in but fails only through Bastion, compare the exact resource targeted by Conditional Access. Policies can distinguish between applications and connection paths.
Fix a local or domain Windows sign-in
If the message appears on a physical Windows sign-in screen, a member server, or a domain controller—not inside AVD, direct Azure RDP, or Bastion—an Azure Conditional Access change is the wrong remedy. Windows User Rights Assignment determines which accounts may log on locally, through Remote Desktop Services, as a service, or through other logon types.
What an administrator should inspect
- Identify the logon type that failed: local interactive sign-in, RDP, console sign-in on a server, or a domain-controller logon.
- Review the applicable Allow log on assignment and every corresponding Deny log on assignment in Local Security Policy or the effective domain Group Policy.
- Check whether the user or a group containing the user is explicitly denied. A deny assignment overrides an allow assignment.
- Run an effective-policy report from an administrator account to find which domain policy is winning, then correct the policy at its source rather than editing a lower-precedence local setting.
- Allow policy refresh, sign out existing sessions if necessary, and test with the intended account type (local, domain, or Entra).
Do not apply the AVD per-user-MFA fix to a Windows User Rights problem. The controlling system and the administrator who must change it are different.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why a correct password still fails
- Conditional Access grant controls: The tenant may require MFA, a compliant device, a trusted location, or a stronger authentication method. Password validation can succeed while the overall access decision fails.
- Legacy per-user MFA conflict: In the documented AVD conflict, per-user MFA and Conditional Access are both active, leaving the session-host sign-in unable to use the expected flow.
- Unsupported MFA method: A policy requiring strong authentication can reject a method that is valid elsewhere. Direct Azure VM RDP commonly requires a supported method such as Windows Hello for Business in the applicable scenario.
- Temporary password: Temporary passwords are not accepted for remote desktop connections.
- Wrong account namespace: Direct Entra RDP may require
AzureADUPN; a cached local or domain name can be interpreted as a different account. - Device or network state: The client’s join state, the VM’s ability to reach Entra dependencies, or the target/Bastion support combination can invalidate the selected method.
- Windows user-rights denial: A local or domain policy can deny the logon type after credentials are otherwise valid.
Choose the fix by policy owner
| Observed situation | First control to inspect | Most likely corrective action |
|---|---|---|
| AVD workspace or desktop fails and sign-in log shows a policy result | Conditional Access targeting Azure Virtual Desktop or Windows Cloud Login | Adjust the matching policy and remove conflicting legacy per-user MFA; require the supported method through Conditional Access |
| Direct VM RDP fails with Entra credentials | Device join state, authentication strength, account format, and password status | Use a supported strong method, complete any temporary-password setup, and enter AzureADUPN where required |
| Bastion portal RDP fails | Target/SKU support, VM reachability to Entra dependencies, and sign-in log | Correct support or network conditions, then satisfy the Conditional Access method selected for Bastion |
| Windows lock screen or domain logon fails | Effective User Rights Assignment | Remove the applicable deny assignment or grant the correct logon right through the authoritative local/domain policy |
Common troubleshooting mistakes
Changing passwords before identifying the path
A password reset addresses only credential validity. Establish the connection path and inspect the relevant policy first.
Testing with a cached credential
RDP clients and browsers can silently reuse an old local or domain identity. Explicitly choose another account and enter the namespace required by the Entra scenario.
Disabling all security controls
Turning off Conditional Access broadly, removing MFA for an entire tenant, or granting unrestricted logon rights hides the cause and creates unnecessary exposure. Make the narrowest change that the sign-in log and effective policy justify, then retest.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Ignoring the time of the failed event
Policy edits and device-state changes are not necessarily visible in every existing session. Match the sign-in log’s time and account to the user’s latest attempt, then start a fresh client session after an approved change.
What to give your administrator
Include the exact error text, connection path, UTC time, user principal name, client operating system, target VM or workspace, whether the password is temporary, and the authentication method selected. For AVD, attach the Conditional Access policy result from the sign-in log. For Bastion, include the Bastion resource, target VM, SKU, and any evidence that the VM cannot reach Entra dependencies. For local or domain Windows, provide the failed logon type and the effective User Rights Assignment report. This information lets the administrator work at the correct tenant, VM, or domain-policy scope instead of guessing.
When the error is resolved
Retest the same path with a new sign-in rather than switching to an unrelated client. Confirm that the permitted method is actually used, that the sign-in log records a successful Conditional Access result where applicable, and that the session reaches the intended desktop or VM. Keep the final policy change documented so a future administrator does not re-enable a conflicting per-user MFA setting or a deny logon assignment.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
