Forum Discussion
Custom role - Microsoft.DesktopVirtualization permissions not complete
When creating a custom role using Microsoft.DesktopVirtualization (with all permissions options selected) not all AzWVD CMDlets can be executed, when this role is assigned to a service principal. All CMDlets can be run without error when the service principal is contributor on the Azure sub. Errors when using the custom role are displayed below:
Disconnect-AzWvdUserSession Error
Disconnect-AzWvdUserSession : The client 'CLIENTIDPLACEHOLDER' with object id 'CLIENTIDPLACEHOLDER' does not have authorization to
perform action 'Microsoft.DesktopVirtualization/hostPools/sessionHosts/userSessions/SUBIDPLACEHOLDER/WVD-Backend/Microsoft.DesktopVirtualization/WVD-
Pool2/WVD-SH000000.ingram.micro/2/action' over scope '/subscriptions/SUBIDPLACEHOLDER/resourceGroups/WVD-Backend/providers/Microsoft.DesktopVirtualiz
ation/hostPools/WVD-Pool2/sessionHosts/WVD-SH000000.ingram.micro/userSessions/subscriptions/SUBIDPLACEHOLDER/resourcegroups/WVD-Backend/providers/Mic
rosoft.DesktopVirtualization/hostpools/WVD-Pool2/sessionhosts/WVD-SH000000.ingram.micro/usersessions/2/disconnect' or the scope is invalid. If access was recently
granted, please refresh your credentials.
Send-AzWvdUserSessionMessage error
Send-AzWvdUserSessionMessage : The client 'CLIENTIDPLACEHOLDER' with object id 'CLIENTIDPLACEHOLDER' does not have authorization to
perform action 'Microsoft.DesktopVirtualization/hostPools/sessionHosts/userSessions/sendMessage/action' over scope '/subscriptions/SUBIDPLACEHOLDER/r
esourceGroups/WVD-Backend/providers/Microsoft.DesktopVirtualization/hostPools/WVD-Pool2/sessionHosts/WVD-SH000001.ingram.micro/userSessions/2' or the scope is invalid.
If access was recently granted, please refresh your credentials.
Both actions are not referenced in the custom role when looking at the JSON display, indicating they still need to be added before the Microsoft.DesktopVirtualization can be used for all CMDlets.
It was the complete list of all permissions in Microsoft.DesktopVirtualization. The issue was fixed by replacing the 3 lines below:
"Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/delete","Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/write","Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/read",by:
"Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/*",Thanks for the follow up though!
2 Replies
- PavithraT
Microsoft
MaranVerweij What is the custom role permissions?
- MaranVerweijCopper Contributor
It was the complete list of all permissions in Microsoft.DesktopVirtualization. The issue was fixed by replacing the 3 lines below:
"Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/delete","Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/write","Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/read",by:
"Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/*",Thanks for the follow up though!