Fix Azure AD Conditional Access Blocking Microsoft 365 on RDS
Question details
Users are being denied access to Microsoft 365 applications from a Remote Desktop Services (RDS) server due to Azure AD Conditional Access policies blocking the connection.
- Product
- Microsoft 365 / Azure AD
- Device & OS
- Windows Server / RDS
- Scenario
- Attempting to access and authenticate Microsoft 365 desktop apps within a Remote Desktop Services environment.
- Observed behavior
- Sign-ins to Microsoft 365 are blocked by Conditional Access, even when the RDS server appears to be Azure AD joined and compliant.
Ensure you have Global Administrator or Conditional Access Administrator privileges in the Microsoft Entra ID (formerly Azure AD) portal to view sign-in logs and modify security policies.
Review Sign-in Logs and Modify Conditional Access Policies
Use the Microsoft Entra ID sign-in logs to identify exactly which Conditional Access policy is blocking the RDS users and adjust the device or location conditions.
When an RDS server connects to Microsoft 365, Conditional Access evaluates the session based on IP address, device state, and operating system. In virtualized environments, the device identity or compliance status might not pass through correctly, triggering a block.
Log in to the Microsoft Entra admin center (or Azure Portal) using your administrator credentials.
Go to Identity > Users > All users. Search for and select a user who experienced the blocked access on the RDS server, then click on 'Sign-in logs' in the left menu.
Locate the failed sign-in attempt corresponding to the RDS session. Click on the log entry to open the Activity Details pane.
In the details pane, select the 'Conditional Access' tab. Identify the specific policy that shows a 'Failure' result.
Check the policy settings under Protection > Conditional Access. Ensure the RDS server's public IP address, operating system, and Azure AD join status meet the strict requirements, or add an exclusion for the RDS environment if necessary.
Try WPS Office for a Seamless and Lightweight Experience
If you are experiencing ongoing authentication blocks with Microsoft 365 in remote or virtualized environments, consider WPS Office. It provides a robust, lightweight alternative that functions perfectly offline without relying on complex Azure AD Conditional Access configurations.
- 1. Download WPS Office: Visit the official WPS website and download the free installation package suitable for your Windows Server or desktop environment.
- 2. Install the Software: Run the installer and follow the on-screen instructions to set up WPS Office on your machine or RDS host.
- 3. Open and Edit Documents: Launch WPS Writer, Spreadsheets, or Presentation to immediately start working with your existing Microsoft Office files.
Frequently Asked Questions
Why does Conditional Access block my Azure AD joined RDS server?
Conditional Access may block the server if the policy requires a specific operating system, a trusted network location, or a compliant device state that the RDS session is failing to pass through to Azure AD during the authentication process.
How do I check if my RDS server is properly Azure AD joined?
You can verify the device registration status by opening a Command Prompt as an administrator on the RDS server and running the command 'dsregcmd /status'. Look for 'AzureAdJoined : YES' in the output.
Can I exclude my RDS server from Conditional Access policies entirely?
Yes, administrators can create a 'Named location' in Microsoft Entra ID for the public IP address of the RDS server. You can then add this location to the exclusion list of the Conditional Access policy that is currently blocking users.
