We are a small company (4 users, 7 devices) and have recently moved from a mess of local accounts on our PCs to using Azure AD for Office 365. The plan was to have accounts for each user and for anyone to log on to any machine with them, and to control access to files on some of the machines accordingly. We don't have (and hopefully don't need) licenses for anything more than what comes free with Microsoft 365 Business Standard. So far so good.
I would also like some employees to be able to remote in to one of the machines in the office. We used to do that by connecting with OpenVPN, then using the standard Windows 10 RDP client. Now, with AAD in place, that only seems to work if the client is AAD Joined. If the client is AAD registered, I get the "Your credentials did not work" and "The logon attempt failed" screen. I would prefer not to join personally owned devices, it feels like registering them is the "correct" way to do it.
Microsoft have a page with requirements to make this work, and I think we satisfy them: Clients are registered in our tenant and show as such on the azure portal. All devices involved are 21H1 or later. Users are in the appropriate groups on the host (and can remote in from joined devices). There must be something else, what am I missing?
