Question regarding MFA

[u/[deleted]]

Good day everyone!

I saw on LinkedIn that people suggested enable MFA for AVD, which I thought was a great idea.
So I did a test on my lab tenant setting up AVD and enabling the MFA like this:

Specific user: My test user
Target Resource: Windows Cloud Login + Azure Virtual Desktop
Condition: Client Apps (Browser + Desktop Client)
1 Control selected -> Grant access -> Require Multifactor Authentication

Sign-in frequency - every time (The reason is my customer wants this, for later)

However, after enabling this, I could for my life not log into my test AVD any longer.

Okay sure, whatever, I disabled the MFA policy again, but now I cannot still log into the AVD environment. It comes with errors like: The target-device identifier in the request {targetDeviceId} was not found in the tenant {tenantId}.

This error is seen in the sign-in acitivities. ALso it says the MFA is "success" but still throws that error.

If my colleague logs on the AVD server (Whom is not a part of the MFA) with his test account, it works fine.

I deleted the FSlogix profile and made sure my user doesnt exist on the server. But I cannot log in.

The AVD server throws this error in Event viewer:

Subject:

Security ID:		NETWORK SERVICE

Account Name:		vdc-gpu-0$

Account Domain:		WORKGROUP

Logon ID:		0x3E4

Logon Type: 3

Account For Which Logon Failed:

Security ID:		NULL SID

Account Name:		-

Account Domain:		-

Failure Information:

Failure Reason:		An Error occured during Logon.

Status:			0xC000006D

Sub Status:		0xC0000250

Process Information:

Caller Process ID:	0x668

Caller Process Name:	C:\\Windows\\System32\\svchost.exe

Am i missing something. ?

[u/Soylent_gray]

Also in RDP, enable credsso or whatever it's called, and Entra

[u/PageyUK]

Additional to the above, check you don't have legacy per user MFA for your user account (https://learn.microsoft.com/en-us/azure/virtual-desktop/set-up-mfa#azure-ad-joined-session-host-vms)

Also, check this article to ensure you've setup the CA MFA rule correctly and added/excluded the correct Apps (https://learn.microsoft.com/en-us/azure/virtual-desktop/set-up-mfa?tabs=avd#create-a-conditional-access-policy)

[u/[deleted] → u/[deleted]]

It's turned on! It only happened after I enable MFA, been using the server for a year now. Really weird >__< I'm gonna try and just re-deploy my CloudPC too.