When using Remote Desktop on Windows 10 and using a Microsoft account to authenticate, the login will sometimes fail if the credentials have not been updated locally. Follow the guidelines below for more information on this issue and steps to take to resolve it.
When using Remote Desktop on Windows 10 and using a Microsoft account to authenticate, the login will sometimes fail if the credentials have not been updated locally. This happens when users only use a pin or picture password when logging in at the local console. This can happen even if the user changes the password on the Microsoft site.
What is happening: When a Microsoft account is linked to a user account in Windows 10, the credentials are cached locally to facilitate offline logins. If the user then switches to using a pin or picture password at the local console, the credentials do not get updated locally, even if the user changes the password on the Microsoft website, the "Manage Microsoft Account" link in Settings, or the "Change Password" utility in Sign-in Options.
This leaves the accounts in an "out-of-sync" state where the local user account still accepts the old password until the Microsoft account, not the pin or picture password, is used to log in to the system locally. If the user then attempts to log in remotely via Remote Desktop, and has changed the Microsoft account password without using it to log in locally afterwards, the remote login will fail because the system is still expecting the old password. This can result in a situation where an old password can be used to access a system remotely, and can be considered a security threat.
After changing your password on the Microsoft account website, you must update the password on the local machine by either signing out or locking the system and signing back in by using the new password. Do not use the pin or picture password--it must authenticate the actual password from the Microsoft authentication servers, or it will continue to accept whatever password was cached the last time the Microsoft account password was used to log in.
It is advised that you always log out/lock your system and log in using the Microsoft account password locally at least once any time you change your password online to prevent this situation.