Bastion does not list 'Login with Entra ID authentication for Windows VM in Azure portal

Hi @Anushree N,

Thank you for reaching out on Microsoft Q&A forum.

When Microsoft Entra ID authentication does not appear as a login option while connecting to a Windows VM through Azure Bastion, it usually means that one or more documented prerequisites are not fully met. As per Microsoft documentation, Entra ID authentication for RDP via Bastion in the Azure portal is still in Public Preview, and the option is displayed only if all conditions are satisfied; otherwise, it is hidden by design.

First, confirm that the Azure Bastion SKU is Standard or higher. Entra ID authentication is not supported on the Basic SKU, and in such cases the portal will not present Entra ID as an authentication method. Next, ensure the VM meets OS requirements—Windows Server 2022 or later is supported, which aligns with your configuration.

Additionally, the VM must have the AADLoginForWindows extension installed and in a Succeeded state. This extension enables Entra ID–based sign‑in, and without it the Bastion connection blade will not surface the Entra ID login option. The connecting user must also be explicitly assigned either the Virtual Machine Administrator Login or Virtual Machine User Login RBAC role on the VM or its scope; having Owner or Contributor alone is not sufficient for sign‑in permissions.

It’s also important to note that Microsoft Entra ID authentication for RDP in the Azure portal via Bastion is currently in Public Preview and is being rolled out gradually across regions. If the feature is not yet enabled in a specific region, such as North Europe, the portal may not show the Entra ID option even when the VM is correctly configured. In such cases, Microsoft recommends using Azure Bastion with the native RDP client (via Azure CLI) as a supported alternative for Entra ID–based authentication.

Refer: https://dotnet.territoriali.olinfo.it/en-us/azure/bastion/bastion-connect-vm-rdp-windows#microsoft-entra-id-authentication-preview

Kindly let us know if the above helps or you need further assistance on this issue.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Hi,

Please confirm that you have provisioned Azure Bastion Basic SKU or higher in the VNet. Developer SKU won't work (for Entra ID). The documentation says that minimum Standard SKU is required, however, in my experience Entra ID auth works with Basic SKU.

In screenshot below, notice it says Provisioning State: Succeeded and if you click on the bastion the Tier needs to be Basic or Standard or Premium. Please verify that yours is Tier: Basic or higher

Thanks.

-TP