Home

Get-RdsTenant : User is not authorized to query the management service.

%3CLINGO-SUB%20id%3D%22lingo-sub-822571%22%20slang%3D%22en-US%22%3EGet-RdsTenant%20%3A%20User%20is%20not%20authorized%20to%20query%20the%20management%20service.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-822571%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3CBR%20%2F%3E%3CBR%20%2F%3EI%20have%20next%20kind%20of%20problem%20with%20WVD.%3CBR%20%2F%3E%3CBR%20%2F%3EOriginally%20we%20created%20WVD%20environment%20somewhere%20at%20the%20beginning%20of%20the%20may%20and%20we%20created%20three%20different%20host%20pools%20which%20still%20works%20nicely.%20Then%20at%20the%20some%20point%20our%20customer%20removed%20from%20local%20AD%20the%20user%20account%20which%20was%20used%20to%20create%20rds-tenant%20and%20after%20that%20we%20have%20been%20able%20to%20log%20in%20to%20RDS%20tenant%2C%20but%20for%20example%20command%20GetRdsTenant%20fails%20with%20error%26nbsp%3B%20%22%3CFONT%3EUser%20is%20not%20authorized%20to%20query%20the%20management%20service%3C%2FFONT%3E%22%20and%20we%20have%20not%20been%20able%20to%20do%20any%20changes%20to%20RDS%20tenant.%3CBR%20%2F%3E%3CBR%20%2F%3EPlease%20also%20note%20that%20it%20is%20my%20guess%20that%20deletion%20of%20user%20account%20which%20was%20used%20for%20provisioning%20of%20RDS%20Tenant%20is%20root%20cause%20of%20this%2C%20but%20from%20timeline%20perspective%20it%20was%20just%20done%20before%20we%20notice%20the%20problem.%3CBR%20%2F%3E%3CBR%20%2F%3EHave%20anyone%20face%20the%20similar%20kind%20of%20situation%20and%20recovered%20it%20somehow%3F%3CBR%20%2F%3E%3CBR%20%2F%3EHere%20you%20have%20list%20of%20tasks%20done%20including%20ActivityID%3A%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3ETasks%20done.%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E1%3C%2FSPAN%3E%3CSPAN%3E.%20WVD%20has%20worked%20and%20we%20were%20able%20to%20create%20tenant%20and%20host%20pool%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E2%3C%2FSPAN%3E%3CSPAN%3E.%20User%20created%20the%20host%20pool%20was%20deleted%20(Could%20be%20it%20has%20nothing%20to%20%3C%2FSPAN%3E%3CSPAN%3Edo%3C%2FSPAN%3E%3CSPAN%3Ewith%20this)%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E3%3C%2FSPAN%3E%3CSPAN%3E.%20After%20removal%20of%20user%20%3C%2FSPAN%3E%3CSPAN%3Ein%3C%2FSPAN%3E%3CSPAN%3Estep%20%3C%2FSPAN%3E%3CSPAN%3E2%3C%2FSPAN%3E%3CSPAN%3Enext%20error%20always%20when%20trying%20to%20make%20changes%20to%20RDS%20tenant%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3C%2FSPAN%3E%3CSPAN%3EGet-RdsTenant%3C%2FSPAN%3E%3CSPAN%3E%3A%20User%20is%20not%20authorized%20to%20query%20the%20management%20service.%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3CSPAN%3EActivityId%3A%20a6768e96%3C%2FSPAN%3E%3CSPAN%3E-%3C%2FSPAN%3E%3CSPAN%3Eb968%3C%2FSPAN%3E%3CSPAN%3E-%3C%2FSPAN%3E%3CSPAN%3E4cb2%3C%2FSPAN%3E%3CSPAN%3E-%3C%2FSPAN%3E%3CSPAN%3Eb00d%3C%2FSPAN%3E%3CSPAN%3E-%3C%2FSPAN%3E%3CSPAN%3Ea83d30ca4625%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E4%3C%2FSPAN%3E%3CSPAN%3E.%20Next%20checks%20done%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20a.%20Permissions%20re%3C%2FSPAN%3E%3CSPAN%3E-%3C%2FSPAN%3E%3CSPAN%3Egranted%20to%20server%20and%20client%20Apps%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20b.%20Tenant%20creation%20roles%20assignment%20checked%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E5%3C%2FSPAN%3E%3CSPAN%3EWhole%20powershell%20responce%20to%20%3C%2FSPAN%3E%3CSPAN%3EGet-RdsTenant%3C%2FSPAN%3E%3CSPAN%3Ecommand%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3C%2FSPAN%3E%3CSPAN%3EGet-RdsTenant%3C%2FSPAN%3E%3CSPAN%3E%3A%20User%20is%20not%20authorized%20to%20query%20the%20management%20service.%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3CSPAN%3EActivityId%3A%20a6768e96%3C%2FSPAN%3E%3CSPAN%3E-%3C%2FSPAN%3E%3CSPAN%3Eb968%3C%2FSPAN%3E%3CSPAN%3E-%3C%2FSPAN%3E%3CSPAN%3E4cb2%3C%2FSPAN%3E%3CSPAN%3E-%3C%2FSPAN%3E%3CSPAN%3Eb00d%3C%2FSPAN%3E%3CSPAN%3E-%3C%2FSPAN%3E%3CSPAN%3Ea83d30ca4625%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20Powershell%20commands%20to%20diagnose%20the%20failure%3A%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3C%2FSPAN%3E%3CSPAN%3EGet-RdsDiagnosticActivities%3C%2FSPAN%3E%3CSPAN%3E-%3C%2FSPAN%3E%3CSPAN%3EActivityId%20a6768e96%3C%2FSPAN%3E%3CSPAN%3E-%3C%2FSPAN%3E%3CSPAN%3Eb968%3C%2FSPAN%3E%3CSPAN%3E-%3C%2FSPAN%3E%3CSPAN%3E4cb2%3C%2FSPAN%3E%3CSPAN%3E-%3C%2FSPAN%3E%3CSPAN%3Eb00d%3C%2FSPAN%3E%3CSPAN%3E-%3C%2FSPAN%3E%3CSPAN%3Ea83d30ca4625%3C%2FSPAN%3E%3C%2FDIV%3E%3CBR%20%2F%3E%3CDIV%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3CSPAN%3EAt%20line%3A%3C%2FSPAN%3E%3CSPAN%3E1%3C%2FSPAN%3E%3CSPAN%3Echar%3A%3C%2FSPAN%3E%3CSPAN%3E1%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3C%2FSPAN%3E%3CSPAN%3E%2B%3C%2FSPAN%3E%3CSPAN%3EGet-RdsTenant%3C%2FSPAN%3E%3CSPAN%3E-%3C%2FSPAN%3E%3CSPAN%3EName%20%3C%2FSPAN%3E%3CSPAN%3E%22tenant%20Name%22%20%23!!!!Tenant%20Name%20changed%20from%20original%20name%20to%20%22tenant%20Name%22%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3C%2FSPAN%3E%3CSPAN%3E%2B%3C%2FSPAN%3E%3CSPAN%3E~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3C%2FSPAN%3E%3CSPAN%3E%2B%3C%2FSPAN%3E%3CSPAN%3ECategoryInfo%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3A%20FromStdErr%3A%20(Microsoft.RDInf...nt.GetRdsTenant%3AGetRdsTenant)%20%5B%3C%2FSPAN%3E%3CSPAN%3EGet%3C%2FSPAN%3E%3CSPAN%3E-%3C%2FSPAN%3E%3CSPAN%3ERdsTenant%3C%2FSPAN%3E%3CSPAN%3E%5D%3C%2FSPAN%3E%3CSPAN%3E%2C%3C%2FSPAN%3E%3CSPAN%3ERdsPowerShellException%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3C%2FSPAN%3E%3CSPAN%3E%2B%3C%2FSPAN%3E%3CSPAN%3EFullyQualifiedErrorId%20%3A%20UnauthorizedAccess%3C%2FSPAN%3E%3CSPAN%3E%2C%3C%2FSPAN%3E%3CSPAN%3EMicrosoft.RDInfra.RDPowershell.Tenant.GetRdsTenant%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-822686%22%20slang%3D%22en-US%22%3ERe%3A%20Get-RdsTenant%20%3A%20User%20is%20not%20authorized%20to%20query%20the%20management%20service.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-822686%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F303236%22%20target%3D%22_blank%22%3E%40vesseli73%3C%2FA%3E%3CBR%20%2F%3EAAD%20Sign%20in%20reports%20error%20code%20%2265001%22%20for%20application%20%22%3CSPAN%3EWindows%20Virtual%20Desktop%3C%2FSPAN%3E%22.%20This%20doesn't%20make%20sense%20as%20user%20is%20included%20as%20tenant%20creator%20for%20a%20application.%3C%2FP%3E%3CDIV%20class%3D%22azc-formElementSubLabelContainer%22%3E%3CDIV%20class%3D%22azc-formElementContainer%22%3E%26nbsp%3B%3C%2FDIV%3E%3C%2FDIV%3E%3CP%3E%3CBR%20%2F%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-822953%22%20slang%3D%22en-US%22%3ERe%3A%20Get-RdsTenant%20%3A%20User%20is%20not%20authorized%20to%20query%20the%20management%20service.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-822953%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F303236%22%20target%3D%22_blank%22%3E%40vesseli73%3C%2FA%3E%26nbsp%3B%3A%20Was%20that%20user%20the%20only%20person%20who%20had%20permission%20on%20the%20RDS%20Tenant%3F%20If%20so%2C%20then%20it%20may%20be%20that%20single-point%20of%20failure%20broke.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-823119%22%20slang%3D%22en-US%22%3ERe%3A%20Get-RdsTenant%20%3A%20User%20is%20not%20authorized%20to%20query%20the%20management%20service.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-823119%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F305776%22%20target%3D%22_blank%22%3E%40christianmontoya%3C%2FA%3E%3CBR%20%2F%3EThanks%20Cristian.%3CBR%20%2F%3EIf%20I%20remember%20correctly%2C%20user%20I%20use%20now%20was%20not%20access%20to%20application%2C%20but%20tone%20another%20might%20had%20that%20moment%2C%20still%20I%20tested%20with%20another%20user%20also%20and%20it%20did't%20work.%20I%20tried%20quite%20many%20things%20after%20facing%20the%20problem%2C%20so%20cannot%20quarantee%20what%20was%20situation%20at%20that%20moment%20and%20it%20was%20somewhere%20at%20June.%20Do%20you%20know%20how%20could%20I%20check%20failure%20point%20and%20if%20possible%2C%20correct%20the%20situation%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
vesseli73
New Contributor

Hello,

I have next kind of problem with WVD.

Originally we created WVD environment somewhere at the beginning of the may and we created three different host pools which still works nicely. Then at the some point our customer removed from local AD the user account which was used to create rds-tenant and after that we have been able to log in to RDS tenant, but for example command GetRdsTenant fails with error  "User is not authorized to query the management service" and we have not been able to do any changes to RDS tenant.

Please also note that it is my guess that deletion of user account which was used for provisioning of RDS Tenant is root cause of this, but from timeline perspective it was just done before we notice the problem.

Have anyone face the similar kind of situation and recovered it somehow?

Here you have list of tasks done including ActivityID:

Tasks done.
1. WVD has worked and we were able to create tenant and host pool
2. User created the host pool was deleted (Could be it has nothing to do with this)
3. After removal of user in step 2 next error always when trying to make changes to RDS tenant
    Get-RdsTenant : User is not authorized to query the management service.
    ActivityId: a6768e96-b968-4cb2-b00d-a83d30ca4625
4. Next checks done
    a. Permissions re-granted to server and client Apps
    b. Tenant creation roles assignment checked
5 Whole powershell responce to Get-RdsTenant command
    Get-RdsTenant : User is not authorized to query the management service.
    ActivityId: a6768e96-b968-4cb2-b00d-a83d30ca4625
    Powershell commands to diagnose the failure:
    Get-RdsDiagnosticActivities -ActivityId a6768e96-b968-4cb2-b00d-a83d30ca4625

    At line:1 char:1
    + Get-RdsTenant -Name "tenant Name" #!!!!Tenant Name changed from original name to "tenant Name"
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : FromStdErr: (Microsoft.RDInf...nt.GetRdsTenant:GetRdsTenant) [Get-RdsTenant], RdsPowerShellException
        + FullyQualifiedErrorId : UnauthorizedAccess,Microsoft.RDInfra.RDPowershell.Tenant.GetRdsTenant
3 Replies

@vesseli73
AAD Sign in reports error code "65001" for application "Windows Virtual Desktop". This doesn't make sense as user is included as tenant creator for a application.

 


 

@vesseli73 : Was that user the only person who had permission on the RDS Tenant? If so, then it may be that single-point of failure broke.

@christianmontoya
Thanks Cristian.
If I remember correctly, user I use now was not access to application, but tone another might had that moment, still I tested with another user also and it did't work. I tried quite many things after facing the problem, so cannot quarantee what was situation at that moment and it was somewhere at June. Do you know how could I check failure point and if possible, correct the situation?

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
38 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies