This is actually a common quirk when mixing Azure AD logins with RDP. What’s happening is that PIN sign‑in is backed by Windows Hello, which uses a local credential provider tied to your device, not the raw password. That’s why the PIN works but the new password doesn’t. The Windows App for Mac, on the other hand, doesn’t support Windows Hello it only tries to pass through the password credential, and if the VM isn’t fully configured with the Azure AD login extension or the right policy settings, you’ll hit the “this login method is not allowed” error.
- Make sure the Azure AD login extension is installed and active on the VM. Without it, password‑based Azure AD sign‑ins can fail even if RDP inside Parallels works.
- Verify that the VM’s Network Level Authentication (NLA) is enabled and that the Azure AD account is allowed for RDP under local security policy.
- Clear any cached credentials in the Windows App for Mac and re‑add the workspace fresh.
- If you’re still blocked, try logging in with the local account first, then switch to Azure AD once inside that can sometimes bypass the credential provider mismatch.
Bottom line: the PIN works because it’s local, the password fails because the app isn’t negotiating Azure AD auth correctly. Getting the extension and policies aligned should fix it.