Switched to passkey/PIN sign-in and now can't RDP into your VM? Flip one .rdp line
Once your org moves to passwordless sign-in (passkey or Windows Hello PIN), the classic RDP credential prompt is a dead end: the remote VM has no passkey and no PIN, so there is nothing to type that it will accept.
The fix is one line in the .rdp file:
enablerdsaadauth:i:1
This is the "Use a web account to sign in to the remote computer" checkbox on the Advanced tab of mstsc. Instead of handing a password to the remote host, the client opens a Microsoft Entra web sign-in on your local machine, where the passkey/PIN actually lives, and passes the resulting token to the VM.
If an old .rdp file still fails after you tick the box in a fresh connection, look inside it. Files saved before the change usually don't omit the setting; they spell it out as disabled:
enablerdsaadauth:i:0
so it silently overrides your new default. Change the 0 to 1. Watch the encoding when editing by script: .rdp files can be UTF-8 with BOM or UTF-16LE, and a naive sed won't match UTF-16 text.
One caveat: this only works for hosts that accept your Entra account ([email protected]). A host that only knows a classic domain login (DOMAIN\user) will reject the web sign-in, so keep enablerdsaadauth:i:0 on those. Different hosts can legitimately need different values; don't "align" them.