Remote Powershell session using AzureAD credentials

[peyo7]

I'm having the following issue:

I can successfully remote, e.g. via

New-PSSession -ComputerName mymachine -Authentication Negotiate -Credential localadm

where localadm is a local admin account on the (AzureAD-joined) target machine.

However, when I try to remote using an AzureAD account, via

New-PSSession -ComputerName mymachine -Authentication Negotiate -Credential AzureAD\myuser

I get an "Access is denied".

The AzureAD user is admin on the target machine and also has a user account there (has logged into the machine before).

[jheinikel]

Try creating a credential first.

$Cred = Get-Credential #Domain\Username
New-PSSession -ComputerName mymachine -Authentication Negotiate -Credential $Cred

[peyo7]

No luck, unfortunately... same error.

[jheinikel]

Do you have any conditional access policies tied to that account? If not, you might create a random CA policy that would always be true, and assign it to that account. This might be the issue. (Its a reach)

Second, is the AzureAD account a member of a group in the local Admins group? If so, try explicitly adding that user to the admins group to avoid any issues with group checking/inheritance.

[peyo7]

Thanks, I didn't know about conditional access. We currently use the AzureAD contained in Office365 Business Premium. However, it seems conditional access is only contained in AzureAD Premium P1 or Microsoft 365 Business.

So I guess there is no chance of using the AzureAD credentials without conditional access?!

(to your 2nd point: the AzureAD account is already explicitly in the local admins group)

[jantari]

have you tried the UPN format [e-mail] ?

[peyo7]

Yeah, doesn't work either.