An existing cloud-only user can authenticate to the AVD feed. On a newly deployed Entra Domain Services-joined host, Windows rejects the password. Managed-domain DNS and connectivity are healthy, and the user has access rights. The user has never changed the password since the managed domain was enabled. What should be checked next?

✓ Correct answer

• Whether the user has changed or reset the password to generate managed-domain-compatible hashes.

Existing cloud users need the password change/reset process that supplies compatible Kerberos and NTLM hashes to the managed domain. Working Entra feed authentication does not demonstrate that those hashes exist. Option explanations: A. Whether the user has changed or reset the password to generate managed-domain-compatible hashes.: The missing password-hash preparation is a documented cause of this difference between cloud and managed-domain sign-in. B. Whether a local Windows account can replace the user's cloud account.: Replacing the user with a local account violates the same-identity requirement and does not repair synchronization. C. Whether the user has Desktop Virtualization Contributor on the subscription.: A management role does not provide the managed domain's password hashes or Windows authentication. D. Whether the host is configured to use a public internet DNS resolver.: Public DNS would not fix managed-domain authentication and could break domain-controller discovery. Sources: Management concepts for Microsoft Entra Domain Services — https://learn.microsoft.com/en-us/entra/identity/domain-services/administration-concepts; Prerequisites for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites

Read the source reference