I do have the following setup:

  • Windows Server 2016 VM running on Azure Cloud and joined to Azure Active Directory Domain
  • Office365 user accounts contained in same AAD as machine is joined to
  • AAD users (not Office365 users)

My problem now is: None of the Office365 users (created in Office365-Portal) except myself can connect to the azure virtual machine via remote desktop - not even other users that are administrators on Office365 and azure.

But: All users that are created in AAD directly (no Office365 licences, created using AAD-Portal, etc.) can connect via RDP without any problem.

On client side, I tried with azure joined Windows 10 devices, but also with non azure joined Windows 7/10.

Any ideas?

Thanks for your kind help.

  • Windows server 2016 can't join to AAD, do you mean Azure AD domain service? your Azure AD is basic or premium? – Jason Ye Nov 14 '17 at 7:47
  • Hi Jason, yes, I mean Azure AD domain service. The Azure AD is basic. – noraab Nov 14 '17 at 10:44
  • As far as I know, Azure AD and O365 user have same permission, does O365 users and AAD users with same suffix? – Jason Ye Nov 15 '17 at 3:04
  • @JasonYe-MSFT If you mean "domain" with "suffix": Yes, it is the same for both user types.I also checked group memberships and tried adding the users as local administrators and remote desktop users on the target machine - unfortunately no change. – noraab Nov 15 '17 at 7:34
  • Azure Active directory domain service's users only sync from Azure AD, does your AAD users and o365 users in the same group? – Jason Ye Nov 15 '17 at 8:39

Any user in Azure AD (regardless if Office365 user or not) needs to change the password after Azure Domain Services have been activated to initiate password sync (see this link).

Thanks Jason for pointing into the correct direction.

| improve this answer | |
  • Thank you for your share, please accept it as an answer so that other community will be benefited, thanks:) – Jason Ye Nov 16 '17 at 3:02

We should add users to AAD DC Administrators group in Azure AD.

Members of AAD DC Administrators can use Remote Desktop to connect remotely to domain-joined machines.

Create an administrative group in your Azure AD directory. This special administrative group is called AAD DC Administrators. Members of this group are granted administrative permissions on machines that are domain-joined to the managed domain. On domain-joined machines, this group is added to the administrators group. Additionally, members of this group can use Remote Desktop to connect remotely to domain-joined machines.

More information about it, please refer to this link.

Hope this helps.


The root case is that, we should enable password synchronization then change the password.

A few minutes after you have changed your password, the new password is usable in Azure Active Directory Domain Services. After about 20 minutes, you can sign in to computers joined to the managed domain using the newly changed password.

More information about change password, please refer to this link.

Thanks for Aaron's share.

| improve this answer | |
  • The provided link was partially useful as it pointed the fact out, that users that existed BEFORE activation of Azure AD domain services need to change their password to be able to use domain-joined machines. After doing so, Office365 users are able to login via RDP, even if they are NOT member of any special group. Thanks Jason. – noraab Nov 15 '17 at 12:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.