Azure Virtual Desktop and Azure AD Join with Enroll VM in Intune - possible pitfall!

[TomWechsler]

Dear Azure Virtual Desktop friends,

If you want to set up Azure Virtual Desktop infrastructure in Azure and you have chosen Azure AD Join and with Enroll VM with Intune, you may get the following error message:

--------------------

[{"code":"VMExtensionProvisioningError","message":"VM has reported a failure when processing extension 'AADLoginForWindows'.
Error message: \"AAD Join failed with status code: -2145648509. AzureSecureVMJoinOperation: DeviceEnroller::AzureSecureVMEnroll
failed 0x801c0083.\"\r\n\r\nMore information on troubleshooting is available at https://aka.ms/vmextensionwindowstroubleshoot "}]}

--------------------

This could possibly be because you have reached the limit for adding devices to Intune.

You can find this information in the Intune Admincenter and increase the value. Either edit the default settings or set up a new Restriction policy.

I realize it's not super, great, extra news, but I ran into these limitations during a deployment and the hints weren't necessarily obvious.

Thank you for taking the time to read the article.

Best regards, Tom Wechsler

P.S. All scripts (#PowerShell, Azure CLI, #Terraform, #ARM) that I use can be found on github! https://github.com/tomwechsler

[#2]

Excellent find, Tom!
Out of curiosity, how quickly after you made the change in Intune were you able to start provisioning hosts again?
(i.e. Do we need to wait for the change to be propagated/replicated to Azure for the error to go away?)
We made the change over 45 minutes ago but are still unable to create an AVD Host.

[#3]

Thank you. I can't say exactly how long it took. But after a logout and login it worked. Regards, Tom