Multifactor Authentication (MFA), Securing Remote Desktop (RDP) with Microsoft Entra Sign-in

For computers that are joined to Microsoft Entra ID, Windows also supports a newer method that authenticates the RDP connection through Microsoft Entra. This allows organizations to apply Microsoft Entra security controls, including Conditional Access, to an RDP connection. This method requires both the client and the remote machine to be running Windows 10, Windows 11, or Windows Server (2022 or later).

Step 1: Open Remote Desktop Connection

Step 2: Open the advanced settings

In Remote Desktop Connection:

  1. Select Show Options.
  2. Select the Advanced tab.
  3. Locate the option:

Use a web account to sign in to the remote computer

     4. Select that checkbox.

Microsoft documents this setting as enabling Microsoft Entra authentication for the RDP connection

 

Step 3: Enter the remote computer name

Return to the General tab and enter the remote computer's hostname.

Do not use the computer's IP address.

When "Use a web account to sign in to the remote computer" is enabled, Microsoft requires the computer to be addressed by hostname, not directly by IP address.

Select Connect.

 

Step 4: Sign in with Microsoft Entra

Instead of the traditional Windows credential prompt, Windows uses Microsoft Entra authentication.

Sign in using your organizational Microsoft Entra account.

If applicable, Microsoft Entra Conditional Access requirements are evaluated as part of authentication to the remote computer.


Keywords:
RDP remote desktop gateway terminal services MFA 2fa entra id sign-in identification authentication 
Doc ID:
165258
Owned by:
Identity and Access Management G. in University of Illinois Technology Services
Created:
2026-11-03
Updated:
2026-11-04
Sites:
University of Illinois Technology Services