SOLVED

User is not authorized to query the management service.

%3CLINGO-SUB%20id%3D%22lingo-sub-1182171%22%20slang%3D%22en-US%22%3EUser%20is%20not%20authorized%20to%20query%20the%20management%20service.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1182171%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20deployed%20WVD%20successfully%20and%20desktop%20is%20the%20only%20published%20app%20in%20my%20panel.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20trying%20to%20publish%20more%20apps%20following%20below%20link%3A%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvirtual-desktop%2Fmanage-app-groups%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvirtual-desktop%2Fmanage-app-groups%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20when%20running%3C%2FP%3E%3CPRE%3E%3CSPAN%3E%3CSPAN%20class%3D%22hljs-pscommand%22%3ENew-RdsRemoteApp%3C%2FSPAN%3E%20%3CTENANTNAME%3E%20%3CHOSTPOOLNAME%3E%20%3CAPPGROUPNAME%3E%3CSPAN%20class%3D%22hljs-parameter%22%3E%20-Name%3C%2FSPAN%3E%20%3CREMOTEAPPNAME%3E%3CSPAN%20class%3D%22hljs-parameter%22%3E%20-AppAlias%3C%2FSPAN%3E%20%3CAPPALIAS%3E%3C%2FAPPALIAS%3E%3C%2FREMOTEAPPNAME%3E%3C%2FAPPGROUPNAME%3E%3C%2FHOSTPOOLNAME%3E%3C%2FTENANTNAME%3E%3C%2FSPAN%3E%3C%2FPRE%3E%3CP%3EI%20get%20this%20error%3A%3C%2FP%3E%3CP%3ENew-RdsRemoteApp%20%3A%3CBR%20%2F%3EActivityId%3A%200cc5d60d-cda7-41f8-981d-e6063e549ec7%3CBR%20%2F%3EPowershell%20commands%20to%20diagnose%20the%20failure%3A%3CBR%20%2F%3EGet-RdsDiagnosticActivities%20-ActivityId%200cc5d60d-cda7-41f8-981d-e6063e549ec7%3CBR%20%2F%3EAt%20line%3A1%20char%3A1%3CBR%20%2F%3E%2B%20New-RdsRemoteApp%20%24TN%20%24HPN%20%24AppGN%20-Name%20Word%20-FilePath%20%22C%3A%5CProgram%20Fi%20...%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThen%20I%20enter%20the%20below%20code%20as%20mentioned%20for%20further%20troubleshooting%20in%20the%20error%20code%3A%3C%2FP%3E%3CP%3E%3CBR%20%2F%3EPS%20C%3A%5CWindows%5Csystem32%26gt%3B%20Get-RdsDiagnosticActivities%20-ActivityId%200cc5d60d-cda7-41f8-981d-e6063e549ec7%3CBR%20%2F%3EGet-RdsDiagnosticActivities%20%3A%20%3CFONT%20color%3D%22%23800000%22%3E%3CSTRONG%3EUser%20is%20not%20authorized%20to%20query%20the%20management%20service.%3C%2FSTRONG%3E%3C%2FFONT%3E%3CBR%20%2F%3EActivityId%3A%20b1a17855-065d-4244-824b-39cbad8eb37d%3CBR%20%2F%3EPowershell%20commands%20to%20diagnose%20the%20failure%3A%3CBR%20%2F%3EGet-RdsDiagnosticActivities%20-ActivityId%20b1a17855-065d-4244-824b-39cbad8eb37d%3CBR%20%2F%3EAt%20line%3A1%20char%3A1%3CBR%20%2F%3E%2B%20Get-RdsDiagnosticActivities%20-ActivityId%200cc5d60d-cda7-41f8-981d-e6063%20...%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20do%20confirm%20that%20my%20user%20has%20permission%20in%20the%20tenant%2C%20has%20Tenant%20creator%2C%20owner%20and%20RDS%20owner.%3C%2FP%3E%3CP%3EI%20followed%20this%20article%3A%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvirtual-desktop%2Ftenant-setup-azure-active-directory%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvirtual-desktop%2Ftenant-setup-azure-active-directory%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20can%20logon%20to%20%3CSPAN%3EWindows%20Virtual%20Desktop%20with%20this%20username%20%3C%2FSPAN%3E%3CSPAN%3Eand%20there%20is%20NOT%20any%20MFA%20enabled%20for%20this%20user.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3ERunning%20%22Get-RdsTenant%22%20returns%20the%20Windows%20Virtual%20Desktop%20tenant%20name.%20%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3E%3CSTRONG%3EWindows%20Virtual%20Desktop%20tenant%20group%20name%3C%2FSTRONG%3E%20is%20%22Default%20Tenant%20Group%22%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EGet-RdsRoleAssignment%20-TenantName%20DRTN%26nbsp%3B%26nbsp%3B%20%3D%3D%3D%26gt%3B%20RoleDefinitionName%20%3A%20%3CSTRONG%3E%3CFONT%20color%3D%22%23800000%22%3ERDS%20Owner%3C%2FFONT%3E%3C%2FSTRONG%3E%20for%20the%20admin%20user%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EI%20don't%20know%20what%20else%20I%20have%20to%20check%20or%20what%20I%20am%20missing%20on%20my%20setup.%20%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3EPlease%20assist.%20%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1187324%22%20slang%3D%22en-US%22%3ERe%3A%20User%20is%20not%20authorized%20to%20query%20the%20management%20service.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1187324%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F563187%22%20target%3D%22_blank%22%3E%40Hanif1138%3C%2FA%3E%3A%20Please%20review%20if%20you%20have%20specified%20the%20tenant%20when%20querying%20the%20diagnostic%20activities%3A%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fmodule%2Fwindowsvirtualdesktop%2Fget-rdsdiagnosticactivities%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fmodule%2Fwindowsvirtualdesktop%2Fget-rdsdiagnosticactivities%3C%2FA%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3EHere%20are%20as%20well%20some%20examples%20specified%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvirtual-desktop%2Fdiagnostics-role-service%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvirtual-desktop%2Fdiagnostics-role-service%3C%2FA%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1188319%22%20slang%3D%22en-US%22%3ERe%3A%20User%20is%20not%20authorized%20to%20query%20the%20management%20service.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1188319%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F139744%22%20target%3D%22_blank%22%3E%40Eva%20Seydl%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20made%20the%20query%20with%20tenant%20name%20-failure%20parameter%20and%20it%20returned%20the%20below%20results%2C%20so%20what%20is%20the%20next%20step%3F%26nbsp%3B%20my%20problem%20is%20that%20I%20can't%20not%20publish%20new%20app%20on%20the%20panel%20as%20I%20explained%20initially%2C%20please%20read%20the%20issue%20properly.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20searched%20in%20the%20community%20and%20unfortunately%20all%20similar%20questions%20to%20mine%20were%20not%20answered%20properly%20or%20solutions%20were%20not%20efficient%2C%20If%20there%20was%20a%20proper%20document%20in%20Microsoft%20and%20coherent%20troubleshooting%20steps%20I%20could%20have%20fixed%20this%20issue%20long%20ago.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CBR%20%2F%3EPS%20C%3A%5CWindows%5Csystem32%26gt%3B%20Get-RdsDiagnosticActivities%20-TenantName%20%24TN%5B0%5D%20-ActivityId%20590a9b6d-28d4-4c3c-bd32-d5dc54e16ca4%20-Detailed%20-Outcome%20Failure%3C%2FP%3E%3CP%3E%3CBR%20%2F%3EActivityId%20%3A%20590a9b6d-28d4-4c3c-bd32-d5dc54e16ca4%3CBR%20%2F%3EActivityType%20%3A%20Management%3CBR%20%2F%3EStartTime%20%3A%202%2F22%2F2020%2011%3A51%3A04%20AM%3CBR%20%2F%3EEndTime%20%3A%202%2F22%2F2020%2011%3A51%3A06%20AM%3CBR%20%2F%3EUserName%20%3A%20admin%40johnkrystaoutlook.onmicrosoft.com%3CBR%20%2F%3ERoleInstances%20%3A%3CBR%20%2F%3EOutcome%20%3A%20Failure%3CBR%20%2F%3EStatus%20%3A%20Completed%3CBR%20%2F%3EDetails%20%3A%20%7B%5BObject%2C%20%2FRdsManagement%2FV1%2FTenantGroups%2FDefault%2520Tenant%2520Group%2FTenants%2FDR1Tenant%2FHostPools%2FDRHoostpool%2FAppGroups%2FDesktop%2520Applic%3CBR%20%2F%3Eation%2520Group%2FRemoteApps%2Fword%5D%2C%20%5BMethod%2C%20Add%5D%2C%20%5BRoute%2C%20RemoteApp%3A%3ACreateRemoteAppAsync%5D%2C%20%5BObjectsFetched%2C%200%5D...%7D%3CBR%20%2F%3ELastHeartbeatTime%20%3A%202%2F22%2F2020%2011%3A51%3A04%20AM%3CBR%20%2F%3ECheckpoints%20%3A%20%7B%7D%3CBR%20%2F%3EErrors%20%3A%20%7BMicrosoft.RDInfra.Diagnostics.Common.DiagnosticsErrorInfo%7D%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1191312%22%20slang%3D%22en-US%22%3ERe%3A%20User%20is%20not%20authorized%20to%20query%20the%20management%20service.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1191312%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F563187%22%20target%3D%22_blank%22%3E%40Hanif1138%3C%2FA%3E%20%3A%26nbsp%3B%20To%20actually%20see%20the%20error%20message%20for%20the%20specific%20issue%20use%20the%20following%20cmdlet%20which%20is%20documented%20under%20%22View%20error%20message%20for%20a%20failed%20activity%20in%20our%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvirtual-desktop%2Fdiagnostics-role-service%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Etroubleshooting%20guidance%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E-%20Get-RdsDiagnosticActivities%20-TenantName%20%3CTENANTNAME%3E%20-ActivityId%20%3CACTIVITYGUID%3E%20-Detailed%20%7C%20Select-Object%20-ExpandProperty%20Errors%3C%2FACTIVITYGUID%3E%3C%2FTENANTNAME%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3EWhen%20you%20look%20at%20the%20error%20for%20your%20activity%20it%20looks%20like%20you%20haven't%20created%20an%20app%20group.%20Here%20the%20link%20on%20how%20to%20manage%20app%20groups%3A%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fvirtual-desktop%2Fmanage-app-groups%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fvirtual-desktop%2Fmanage-app-groups%3C%2FA%3E%20%3C%2FFONT%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

Hi All,

 

I have deployed WVD successfully and desktop is the only published app in my panel.

 

I am trying to publish more apps following below link:

https://docs.microsoft.com/en-us/azure/virtual-desktop/manage-app-groups

 

But when running

New-RdsRemoteApp <tenantname> <hostpoolname> <appgroupname> -Name <remoteappname> -AppAlias <appalias>

I get this error:

New-RdsRemoteApp :
ActivityId: 0cc5d60d-cda7-41f8-981d-e6063e549ec7
Powershell commands to diagnose the failure:
Get-RdsDiagnosticActivities -ActivityId 0cc5d60d-cda7-41f8-981d-e6063e549ec7
At line:1 char:1
+ New-RdsRemoteApp $TN $HPN $AppGN -Name Word -FilePath "C:\Program Fi ...

 

Then I enter the below code as mentioned for further troubleshooting in the error code:


PS C:\Windows\system32> Get-RdsDiagnosticActivities -ActivityId 0cc5d60d-cda7-41f8-981d-e6063e549ec7
Get-RdsDiagnosticActivities : User is not authorized to query the management service.
ActivityId: b1a17855-065d-4244-824b-39cbad8eb37d
Powershell commands to diagnose the failure:
Get-RdsDiagnosticActivities -ActivityId b1a17855-065d-4244-824b-39cbad8eb37d
At line:1 char:1
+ Get-RdsDiagnosticActivities -ActivityId 0cc5d60d-cda7-41f8-981d-e6063 ...

 

I do confirm that my user has permission in the tenant, has Tenant creator, owner and RDS owner.

I followed this article:

https://docs.microsoft.com/en-us/azure/virtual-desktop/tenant-setup-azure-active-directory

 

I can logon to Windows Virtual Desktop with this username and there is NOT any MFA enabled for this user.

 

Running "Get-RdsTenant" returns the Windows Virtual Desktop tenant name.

 

Windows Virtual Desktop tenant group name is "Default Tenant Group"

 

Get-RdsRoleAssignment -TenantName DRTN   ===> RoleDefinitionName : RDS Owner for the admin user

 

I don't know what else I have to check or what I am missing on my setup.

Please assist.

 

3 Replies

@Hanif1138: Please review if you have specified the tenant when querying the diagnostic activities:

https://docs.microsoft.com/en-us/powershell/module/windowsvirtualdesktop/get-rdsdiagnosticactivities

 

Here are as well some examples specified: https://docs.microsoft.com/en-us/azure/virtual-desktop/diagnostics-role-service

 

 

@Eva Seydl 

 

I made the query with tenant name -failure parameter and it returned the below results, so what is the next step?  my problem is that I can't not publish new app on the panel as I explained initially, please read the issue properly. 

 

I searched in the community and unfortunately all similar questions to mine were not answered properly or solutions were not efficient, If there was a proper document in Microsoft and coherent troubleshooting steps I could have fixed this issue long ago. 

 


PS C:\Windows\system32> Get-RdsDiagnosticActivities -TenantName $TN[0] -ActivityId 590a9b6d-28d4-4c3c-bd32-d5dc54e16ca4 -Detailed -Outcome Failure


ActivityId : 590a9b6d-28d4-4c3c-bd32-d5dc54e16ca4
ActivityType : Management
StartTime : 2/22/2020 11:51:04 AM
EndTime : 2/22/2020 11:51:06 AM
UserName : admin@johnkrystaoutlook.onmicrosoft.com
RoleInstances :
Outcome : Failure
Status : Completed
Details : {[Object, /RdsManagement/V1/TenantGroups/Default%20Tenant%20Group/Tenants/DR1Tenant/HostPools/DRHoostpool/AppGroups/Desktop%20Applic
ation%20Group/RemoteApps/word], [Method, Add], [Route, RemoteApp::CreateRemoteAppAsync], [ObjectsFetched, 0]...}
LastHeartbeatTime : 2/22/2020 11:51:04 AM
Checkpoints : {}
Errors : {Microsoft.RDInfra.Diagnostics.Common.DiagnosticsErrorInfo}

best response confirmed by Eva Seydl (Microsoft)
Solution

@Hanif1138 :  To actually see the error message for the specific issue use the following cmdlet which is documented under "View error message for a failed activity in our troubleshooting guidance.

- Get-RdsDiagnosticActivities -TenantName <tenantname> -ActivityId <ActivityGuid> -Detailed | Select-Object -ExpandProperty Errors

 

When you look at the error for your activity it looks like you haven't created an app group. Here the link on how to manage app groups:

https://docs.microsoft.com/azure/virtual-desktop/manage-app-groups