Error: User is not authorized to query the management service

[Christopher Anderson]

When following the directions below, I always run into an error related to querying the management service.

https://docs.microsoft.com/en-us/azure/virtual-desktop/create-host-pools-azure-marketplace

Error message from the Azure portal:

"error": { "code": "VMExtensionProvisioningError", "message": "VM has reported a failure when processing extension 'dscextension'. Error message: \"DSC Configuration 'FirstSessionHost' completed with error(s). Following are the first few: PowerShell DSC resource MSFT_ScriptResource failed to execute Set-TargetResource functionality with error message: User is not authorized to query the management service.

I'm logged in as a user that in the global admin role in Azure AD, and it's also a user in the Windows Virtual Desktop enterprise application.  I've consented to the graph and Azure AD permissions under the enterprise app as well, any ideas?

[#2]

I have the same problem. Does anyone have some ideas?

[#3]

I'm getting the exact same thing. Any news or updates on this?

[#4]

Could this be my problem? The instructions point to infrastructure requirements which says it needs the following things.....
-An Azure Active Directory
-A Windows Server Active Directory in sync with Azure Active Directory.
-An Azure subscription, containing a virtual network that either contains or is connected to the Windows Server Active Directory.

I don't have a local ad synced to azure ad. I only have azure ad.
The instructions seems to refer that you need all of it.

[#5]

@Christopher Anderson , @Patrick F , @Seth Zwicker : The reason you see the "User is not authorized to query the management service" from the DSC extension is because the user who you provided in the last blade (where you also defined your Windows Virtual Desktop tenant name) does not have permissions in the tenant that you specified. A couple things you can check:

• Did you create a tenant from these steps: https://docs.microsoft.com/azure/virtual-desktop/tenant-setup-azure-active-directory ?
• Can you login to Windows Virtual Desktop with the username you provided in the last blade of Azure Marketplace offering, and does it require MFA to login? If that account does require MFA, it will not work when running as part of the script because there's no UI to prompt you for that second factor.
• After logging in with that user account, can you run "Get-RdsTenant" to make sure that same Windows Virtual Desktop tenant shows appears?
• Double/triple check that you entered the right values in the Azure Marketplace offering. For the most part, the Windows Virtual Desktop tenant group name should remain as "Default Tenant Group" and make sure to enter the Windows Virtual Desktop tenant name you created earlier, not a new one.

Thanks for testing and your patience here. We're compiling this same information and generating a Troubleshooting guide that hopefully should help you get unblocked yourself!

[#6]

@Christopher Anderson 

I have the same issue too after following the instructions.

 New-RdsTenant -Name 'projectstest' -AadTenantId xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx -AzureSubscriptionId xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx
New-RdsTenant : User is not authorized to query the management service.
ActivityId: xxxxxxx-9dec-485a-82ee-xxxxxxxxxxx
Powershell commands to diagnose the failure:
Get-RdsDiagnosticActivities -ActivityId xxxxxxx-9dec-485a-82ee-xxxxxxxxxx
At line:1 char:1
+ New-RdsTenant -Name 'projectstest' -AadTenantId xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : FromStdErr: (Microsoft.RDInf...nt.NewRdsTenant:NewRdsTenant) [New-RdsTenant], RdsPowerSh
ellException
+ FullyQualifiedErrorId : UnauthorizedAccess,Microsoft.RDInfra.RDPowershell.Tenant.NewRdsTenant
Followed the guide here https://docs.microsoft.com/en-us/azure/virtual-desktop/tenant-setup-azure-active-directory

Turned off MFA for the account.

Granted permissions for client and server here https://rdweb.wvd.microsoft.com/

Granted permissions here for Virtual desktop https://aad.portal.azure.com

[#7]

@christianmontoya I checked those steps again and I'm still not sure what I'm missing.  I reproduced the error outside of the template in PowerShell by doing the following:

1.  Created a new user account in Azure AD and put it in the TenantCreator role for Windows Virtual Desktop.

2.  Opened PowerShell as an admin, and added / logged into the account above using Add-RdsAccount

3.  Attempted to call Remove-RdsTenant as part of clean up to try and see if I could execute the template from scratch

[#8]

I was able to work around this issue.  Here is what I noted:

1.  Regardless of account, you don't seem to be able to delete existing tenant groups once their created using the Remove-RdsTenant account.  I always get the "user is not authorized to query the management service" error no matter what I do.

2.  Also, one of the steps I may have missed the first time is that the tenant group name you create via PowerShell has to match to what you create via the Azure portal.  After creating a new tenant group in Powershell separate from the default one, it worked when I referenced the new tenant group name in the Azure portal.  Hopefully at some point, Microsoft will have an end-to-end solution for creating the tenant, tenant group name, and host pool all within the portal. 

[#9]

@Christopher Anderson : Just to clarify, the "tenant group" name should always be "Default Tenant Group". Only in very few circumstances does this change. But yes, you always need to provide the same "tenant" name everywhere you go.

[#10]

@Christopher Anderson : Yes, I definitely support the last message, that one of our goals is to have all of this functionality straight from the Azure portal, without having to hop around everywhere.

Thank you for all of the feedback, and keep it coming!

[#11]

Maybe it helps someone getting WVD up and running: https://erjenrijnders.nl/2019/04/04/how-to-deploy-windows-virtual-desktop-in-azure/ Using the service principal with the correct permissions worked for me.

[#12]

@Erjen Rijnders, firstly thank you for pulling together that post and the associated PowerShell. It certainly makes the first steps for setting up WVD easier. However, my efforts in this are still failing on that last step in the Azure deployment /dscextension with the error:

" PowerShell DSC resource MSFT_ScriptResource  failed to execute Set-TargetResource functionality with error message: User is not authorized to query the management service."

I'm wondering exactly what the step is doing? I've remoted on to the VM which gets created and tired trawling through the event logs but there are no more details. I have also tried using just a UPN rather than your suggestion of service principle. It is a real head scratcher!

I'm going to go off and create a brand new AAD tenant and AAD DS resource just to rule out anything related to our existing corporate AAD tenant. Wish me luck :)

[#13]

Hi @andrewstollery, Thanks and welcome. What is the result of this command?
Get-RdsRoleAssignment

You should set something like this.

Especially, the appid must be the same as the app you created earlier:
New-RdsRoleAssignment -RoleDefinitionName "RDS Owner" -ApplicationId $svcPrincipal.AppId -TenantGroupName $myTenantGroupName -TenantName $myTenantName -HostPoolName $hostpoolname

That AppID must be the same as the app you visited in the Azure Portal, creating te new key and used during the deployment of the Azure Marketplace WVD template.

And make sure, that the user you are using joining the VM's to the domain, is also having Owner access on the Azure subscription.
It needs to be able to run PowerShell DSC on the VM's.

[#14]

@Erjen Rijnders 

Hey i am also have the same issue i followed both the microsoft guide and Erjen guild and failing on the DSCextension. I am thinking the problem is with AADDS. Has anyone made it work with AADDS?

---

thanks

[#15]

@Stavros Mitchell, I have not tested with AAD DS, but from what I know, in the preview version you need a working AD Connect, meaning that you can only use an onprem AD. I hope they remove it from the production version.

[#16]

Hi @Erjen Rijnders, thank you for the prompt reply. Given the number of times I've run this now, I actually get 5 RoleAssigmentIds returned...oops. How do I tidy those up? Using Remove-RdsRoleAssigment I guess? I'll have a crack at that later...

The last one in the list though is the correct one:

I guess the only difference for me is that I am using AAD DS too, which you stated below is not supported. I'm not sure why not? I can get the VM to join the AAD DS domain. It is the DSCextension step which fails.

Anyhow, I'll do some tidying up and also keep progressing with my greenfield AAD, AAD DS and WVD deployment.

[#17]

@andrewstollery, you did create a new key within that app from the Azure Portal right? And you used that key during deployment on step 4?

And the user you are using deploying the VM's, does have owner rights on the Azure Subscription?

I agree it should work, however with AAD DS you don't have access to the RPC-service. So that could be the reason it doesn't work. But still curious if you checked the points I just mentioned.

[#18]

@andrewstollery 

I am pretty sure the issue is AADDS. I think i will set up a VM for active directory and link it to AADDS and see if that corrrects my issue

[#19]

Hi Erjen,

Yes, my friend, I created my service principles key and used that. I listened to everything you wrote, you know what you are doing so I didn't want to assume anything :). I also doubled checked the VM deployment user is Owner on the subscription and it is.

I really appreciate your help with this, thank you for replying.

[#20]

Alright, than it must be the AAD DS limitation indeed..

[#21]

Hi @Stavros Mitchell,

I'm inclined to agree now. I've finished a completely new setup:

• AAD Tenant
• AAD DS Resource
• Followed Erjen's excellent deployment steps for WVD

Deployment fails at the /dcsextension step every time with the error "PowerShell DSC resource MSFT_ScriptResource failed to execute Set-TargetResource functionality with the error message: User is not authorized to query the management service"

I'm still not sure I understand why WVD requires a full-blown ADDS domain controller to work? Perhaps a Microsoft representative can shed some light on this? Anyway, just like you, I am not prepared to give up! :)

Next step is to deploy an IaaS ADDS VM and use AAD Connect to sync up to AAD and then run the WVD setup again...watch this space! 

[#22]

@andrewstollery 

According to Microsoft Document

A Windows Server Active Directory in sync with Azure Active Directory. This can be enabled through:

• Azure AD Connect
• Azure AD Domain Services

I am trying to see how that works I didn't know you can create a new Windows Server Active Directory and sync with AADDS. I have always used AD Connect. Unless i am misunderstanding the requirements

[#23]

Yeah, I was after the why? :)

[#24]

Maybe check if there is a conditional access policy applying to the admin account you specified in the deployment steps.

[#25]

@Stavros Mitchell @andrewstollery : Yes, you would always use Azure AD Connect to synchronize your Windows Server AD up to Azure AD. However, if you are a cloud organization and have no Windows Server AD, then you can use Azure AD Domain Services to create a managed Windows Server AD on the virtual network that would have the same users as your Azure AD.

The intent was that these are each mechanisms that will allow the users to be recognized both "in the cloud" and "on-prem". We can change the wording to make that more clear. Open to suggestions!

[#26]

@andrewstollery 

ok so i got it to work with only AADDS i followed this guide. I think my issue was the users i was putting to allowe. I left it blank this time and it worked

http://www.rebeladmin.com/2019/04/step-step-guide-azure-windows-virtual-desktop-preview/

[#27]

I am also having many of the same issues covered in this thread trying to deploy Windows Virtual Desktop Preview.

I have followed all of the directions linked in this thread, including Erjen's very useful blog post and I am still getting the dreaded "User is not authorized to query the management service" failure during the DSCExtension part of the deployment.

My deployment user is a subscription owner, I have my regular AD synced with AAD complete with password hash sync, I created Service Principles with RDS Owner permissions/roles and used the APP IDs and Keys for the Tenant Admin credentials. I have tried deploying without any default users set, but despite all of this I still get the same failure.

This is extremely frustrating.

[#28]

When I try and deploy using my subscription owner UPN for the Tenant Admin credentials instead of the Service principle credentials, I get a different error on the DSCExtention phase of the deployment...

VM has reported a failure when processing extension 'dscextension'. Error message: \\\"DSC Configuration 'FirstSessionHost' completed with error(s). Following are the first few: PowerShell DSC resource MSFT_ScriptResource failed to execute Set-TargetResource functionality with error message: One or more errors occurred. The SendConfigurationApply function did not succeed

[#29]

@GriffinDodd : Are you able to install the PowerShell locally and try logging in with that service principal? Also, the other requirement for the service principal is that it must be created as a "Converged app" or as "multi-tenant" because our service currently uses a 3rd party Azure AD application for authentication.

[#30]

@christianmontoya I created the service principal following the guidelines laid out in Erjens blog post.

I have tried two methods, one where you create the tenant and service principle as illustrated in Erjen's directions, another where you use the Managed Domain as the tenant and use Managed Domain admin credentials, both give the same errors.

Here is how I am creating the tenant...

New-RdsTenant -Name <my tenant name> -AadTenantId <aad id> -AzureSubscriptionId <AZ sub id>

$myTenantGroupName = "Default Tenant Group"
$myTenantName = "<my tenant name>" #As you used in the previous step
$hostpoolname = "<my host pool name>"

# create the service principal:
$aadContext = Connect-AzureAD
$svcPrincipal = New-AzureADApplication -AvailableToOtherTenants $true -DisplayName "Windows Virtual Desktop Svc Principal"
$svcPrincipalCreds = New-AzureADApplicationPasswordCredential -ObjectId $svcPrincipal.ObjectId

# Don't change the URL below.
Add-RdsAccount -DeploymentUrl "https://rdbroker.wvd.microsoft.com"
Set-RdsContext -TenantGroupName $myTenantGroupName
New-RdsHostPool -TenantName $myTenantName -name $hostpoolname

New-RdsRoleAssignment -RoleDefinitionName "RDS Owner" -ApplicationId $svcPrincipal.AppId -TenantGroupName $myTenantGroupName -TenantName $myTenantName -HostPoolName $hostpoolname

[#31]

I created my tenant like this....

New-RdsTenant -Name <my tenant name> -AadTenantId <aad id> -AzureSubscriptionId <az sub id>

$myTenantGroupName = "Default Tenant Group"
$myTenantName = "<my tenant name>" #As you used in the previous step
$hostpoolname = "<my pool name>"

# create the service principal:
$aadContext = Connect-AzureAD
$svcPrincipal = New-AzureADApplication -AvailableToOtherTenants $true -DisplayName "Windows Virtual Desktop Svc Principal"
$svcPrincipalCreds = New-AzureADApplicationPasswordCredential -ObjectId $svcPrincipal.ObjectId

# Don't change the URL below.
Add-RdsAccount -DeploymentUrl "https://rdbroker.wvd.microsoft.com"
Set-RdsContext -TenantGroupName $myTenantGroupName
New-RdsHostPool -TenantName $myTenantName -name $hostpoolname

New-RdsRoleAssignment -RoleDefinitionName "RDS Owner" -ApplicationId $svcPrincipal.AppId -TenantGroupName $myTenantGroupName -TenantName $myTenantName -HostPoolName $hostpoolname

[#32]

@christianmontoya See above regarding Tenant and Service Principal creation.

On trying to log in to Azure with the service principal I seem to be able to log in and see the Account ID, a blank subscriptionName (????), TenantID and Environment listed as AzureCloud

[#33]

@christianmontoya I recreated the RDS Owner role for the Service Principle Tenant, and I still get this error...

DSC Configuration 'FirstSessionHost' completed with error(s). Following are the first few: PowerShell DSC resource MSFT_ScriptResource failed to execute Set-TargetResource functionality with error message: User is not authorized to query the management service

[#34]

@GriffinDodd Did you run the Add-RdsAccount command? To run using Service Principal credentials I run the command: 

Add-RdsAccount -DeploymentUrl "https://rdbroker.wvd.microsoft.com" -ServicePrincipal -AadTenantId "[add-your-id]"

Then enter the Service Principal AppId and password.

Running get-rdscontext should then show the username as ServicePrincipal.

[#35]

@tilikumtim I went through the steps you provided, however my username is returned as blank, 

PS C:\WINDOWS\system32> get-rdscontext

DeploymentUrl                                         TenantGroupName                            UserName
------------- --------------- --------
https://rdbroker.wvd.microsoft.com        Default Tenant Group

My role assignment looks like this..

RoleAssignmentId : xxxxx-xxxx-xxxx-xxxx-xxxxxxx
Scope : /Default Tenant Group/LMRVVDTENANT/LMRVpoolname
TenantGroupName : Default Tenant Group
TenantName : LMRVVDTENANT
HostPoolName : LMRVpoolname
DisplayName :
SignInName :
GroupObjectId :
AADTenantId :
AppId : xxxxx-xxxx-xxxx-xxxx-xxxxxxx
RoleDefinitionName : RDS Owner
RoleDefinitionId : xxxxx-xxxx-xxxx-xxxx-xxxxxxx
ObjectId : xxxxx-xxxx-xxxx-xxxx-xxxxxxx
ObjectType : ServicePrincipal
Item :

I inspected the Manifest for my Svc Principal and noticed on line 2 that the appRoles value was empty, is that correct? Should it read "RDS Owner" ???

[#36]

After completely remaking my Tenant and Service Principal I was finally able to to get a successful deployment using my UPN rather than AppID and secret.

However now, I see two Session Desktops (with no icon) in my rdweb feed, double clicking either of them errors out trying to launch an rdp file at an invalid path local path on my PC. Instead of having my proper name of "xxx xxx Dodd" (my user folder) at the beginning of the path, it simply has "Dodd" so obviously it cannot find the RDP file. When I drill down to where the RDP files are stored (along with their icons) and try and manually launch them with the remote desktop app the connection also fails with the error

"The RDP file provided is invalid. Make sure the file contains the full address and is formatted properly or contact your admin for help"

Also when in Office 365, launching the 'Windows Virtual Desktop' app resolves to an invalid URL after first trying to hit a session at account.activedirectory.windowsazure.com/applications/signin/xxxxxx and ends at https://mrs-prod.ame.gbl/mrs-RDInfra-prod

[#37]

I have been able to successfully connect through the web client at 
https://rdweb.wvd.microsoft.com/webclient/index.html

although I still see the ghost 'session desktop' icon in my feed from previous failed deployment attempts, so I need to find a way to kill that as that doesn't work. 

But progress!!!

[#38]

@GriffinDodd : You can remove that extra "session desktop" by finding that host pool and app group, and running "Remove-RdsAppGroupUser". You can then also remove the app group (Remove-RdsAppGroup) and host pool (Remove-RdsHostPool).

[#39]

@GriffinDodd : Currently, when running service principal, the name does not come up. We are tracking this. However, it does show correctly that it is an RDS Owner (if you look at RoleDefinitionName.

[#40]

Hi All, 

My deployment is unable to join ADDS domain.

I continue to get this error, not sure why as I am able to spin up a VM on the VNet and join domain manually. The user is in AAD DC admin group. Am I missing something here? 

{ "code": "VMExtensionProvisioningError", "message": "VM has reported a failure when processing extension 'joindomain'. Error message: \"Exception(s) occured while joining Domain '....onmicrosoft.com '\"." }

[#41]

@heng008 : If you can get to the VM (either through a public IP address or by connecting through another VM on the network), you should be able to check out the errors from the domainJoin extension log. It would be under C:\Packages\ and there should be a folder for domainJoin. There should be a log (or a .status) file down in that folder that should explicitly say what the error is. (This is an extension we don't manage, but use, so that's why I'm uncertain of exact file location.)

[#42]

@christianmontoya could you explain how to do this, I'm not much of a powershell ninja

[#43]

I have suffered from this not matter what I have tried I have tried every step even with someone watching over my should and double checkin my work.   Must have tried and failed 40 times, and that included rebuilding a new principle tearing down tenants etc...  I was doing it because our domains have MFA.  I finally said I am just going to try that link that says to Create Host Pool with Powershell.  Was done in 15 minutes....  The SPN/APP needs help.  Also, order of Docs seems very off to me.  Link to PowerShell build of Hostpool Create a host pool with PowerShell

@Christopher Anderson 

[#44]

@ccbrownkc : What would be the preferred order to help complete the onboarding?

[#45]

---

@Erjen Rijnders wrote:

And make sure, that the user you are using joining the VM's to the domain, is also having Owner access on the Azure subscription.
It needs to be able to run PowerShell DSC on the VM's.

---

@Erjen Rijnders 

Do you have any pointers to this? I have not seen this mentioned anywhere else, and I am not satisfied with having a local AD user have owner rights on a subscription.

For other reasons I am going to remove my WVD setup and start over, and I want to be sure to do every little bit right this time :)

Thanks!

[#46]

@Oletho I think it was in the Microsoft docs at first but not sure. But at least you can try it for testing purposes en take away the permissions later. The deployment of WVD won't tell you if you have not enough permissions on your subscription. But I think the "Virtual Machine Contributor" role should work too.

[#47]

@Oletho : The local AD user that will domain-join the VMs does not need to have any Azure permissions (my test tenant certainly does not). 

[#48]

@christianmontoya then how is it able to push PowerShell DSC commands? You need permissions on your Azure tenant.

[#49]

@Erjen Rijnders @christianmontoya

My hostpool succeeded, domain joining with a local AD user (not AAD sync'ed) with no permissions but joining computers to my local AD. Exactly the behaviour I was hoping for.

I cannot tell about the PS DSC question, but all lights are green and I take that as a good sign.

[#50]

@Erjen Rijnders : The permission to retrieve and run DSC is authorized when you run the template. Afterwards, as long as the VM can reach out and download the DSC package, it will run it (not exactly sure if it runs in the context of the local admin or the Azure VM Agent).