Azure / Azure/azure-cli

az network bastion rdp presents complications with Entra ID authentication when the Windows VM hostname does not match the Azure resource name

Open
#30,226 5 comments 4 reactions 0 assignees View on GitHub
act-quality-productivity-squad Auto-Assign customer-reported Network - Bastion Service Attention Similar-Issue
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Scenario**

1. We create a Windows Virtual Machine, with hostname that does not match the Azure resource name. For example, the Azure resource name might be: `someprojectname-test-vm` and the Windows hostname `spn-test-vm` to satisfy the limitation of 15 characters long hostnames.

```bicep
resource vm 'Microsoft.Compute/virtualMachines@2020-06-01' = {
name: vmName // <-- Azure Resource Name
location: location
properties: {
osProfile: {
computerName: computerName // <--- Windows Hostname (max 15 characters long)
```

2. We enable Entra ID authentication installing the AADLoginForWindows extension.

**Expectation**

Using the `az network bastion rdp --enable-mfa` command to RDP into the VM using the native client in Windows should work. Instead, it fails with an error message _"The target-device identifier in the request someprojectname-test-vm was not found in the tenant"_ like in the following picture:

![Image](https://github.com/user-attachments/assets/f838b512-a6f5-4b94-a25a-c883207efd95)

**Diagnosis and workaround**

The problem occurs because the Windows VM is registered in Entra ID using the hostname (spn-test-vm), while the `az network bastion rdp` command assumes that the hostname matches the Azure resource name.

As a workaround, we can use the `--configure` flag, save the RDP file on disk, use a text editor to replace the name of the Azure resource with the hostname, and RDP successfully in the VM.

```ps1
az network bastion rdp --name $bastionName --resource-group $resourceGroupName --target-resource-id $vmResourceId --enable-mfa --configure
```

**Possible solution (maybe)?**

Enrich the `az network bastion rdp` command to support specifying the hostname of the target VM, or obtain automatically the right hostname by Azure resource name?

It is not feasible to assume that the Azure resource name must match the Windows hostname in all cases because of the limitation of having 15 characters long hostnames. Azure resources can easily have longer names.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.