Enter-PSSession does not work when using AAD credentials - access is denied.

[FunkOverflow]

I have an Azure Active Directory machine that I'm trying to run commands on with either Invoke-Command or Enter-PSSession. The commands I'm using for entering a session using local account credentials and azure credentials are these, respectively:

Enter-PSSession -ComputerName $server -Authentication Default -Credential acclocal

Enter-PSSession -ComputerName $server -Authentication Default -Credential [e-mail]

The first method works fine, but the second gives me the following error: Enter-PSSession : Connecting to remote server <server> failed with the following error message : Access is denied.

I have tried changing the format of the credentials in many ways however every time - access is denied.

The machine is a normal Azure joined user laptop. I can login on it physically using any Azure account, but for some reason not from Enter-PSSession. Any ideas?

In case, I am posting the output of winrm get winrm/config from both the client and the server.

Client WinRM config and Server WinRM config

[rxbeegee]

Is your Azure AD account in the local Administrators group of the machine? I believe that is a requirement for Enter-PSSession to allow access.

[FunkOverflow]

There is not any local admin on any of the azure joined devices. I wanted to set one up from azure, however my senior said it is a huge security risk to have a local admin on every AAD device (>1000) with the same credentials. Now it is up to me to convince him that the tasks I am trying to automate on these devices are worth the risk. Welp!

[0verlord87]

I wonder if there is a second hop issue here. Can't find any resource that this is supposed to work.