SOLVED

CAA20004 - AADSTS65005 - The app needs access to a service

%3CLINGO-SUB%20id%3D%22lingo-sub-1403787%22%20slang%3D%22en-US%22%3ECAA20004%20-%20AADSTS65005%20-%20The%20app%20needs%20access%20to%20a%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1403787%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%3CBR%20%2F%3EI've%20recently%20deployed%20WVD%20Spring%202020%20and%20my%20users%20report%20the%20following%20error%20with%20the%20WVD%20client%3C%2FP%3E%3CP%3E%22AADSTS65005%20-%20The%20app%20needs%20access%20to%20a%20service.%26nbsp%3B%20%3CA%20href%3D%22https%3A%2F%2Fmrs-prod.ame.gbl%2Fmrs-RDInfra-prod%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fmrs-prod.ame.gbl%2Fmrs-RDInfra-prod%3C%2FA%3E%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EUsers%20report%20no%20issues%20using%20the%20HTML5%20client.%26nbsp%3B%20%26nbsp%3BWhat%20did%20I%20miss%20during%20the%20configuration%20process%3F%3C%2FP%3E%3CP%3ENote%3A%26nbsp%3B%20I've%20registered%20the%26nbsp%3B%3CSPAN%3EMicrosoft.DesktopVirtualization%20resource%20provider%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EHow%20do%20I%20resolve%20this%20issue%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EThanks%2C%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3ED%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1404057%22%20slang%3D%22en-US%22%3ERe%3A%20CAA20004%20-%20AADSTS65005%20-%20The%20app%20needs%20access%20to%20a%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1404057%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20realized%20that%20I%20did%20not%20provide%20consent%20for%20the%20WVD%20server%20and%20client%20app.%26nbsp%3B%20I%20believe%20the%20Spring%202020%20documentation%20is%20missing%20references%20to%20provide%20consent.%26nbsp%3B%20Perhaps%20MS%20could%20update%20their%20r%20documentation%20to%20mitigate%20the%20issue%20with%20other%20clients%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20fixed%20the%20issue%20by%20following%20the%20steps%20below%20(pulled%20from%20the%20Fall%202019%20documentation)%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3COL%3E%3CLI%3EOpen%20a%20browser%20and%20begin%20the%20admin%20consent%20flow%20to%20the%20Windows%20Virtual%20Desktop%20server%20app.%26nbsp%3B%20%3CA%20href%3D%22https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Fadminconsent%3Fclient_id%3D5a0aa725-4958-4b0c-80a9-34562e23f3b7%26amp%3Bredirect_uri%3Dhttps%253A%252F%252Frdweb.wvd.microsoft.com%252FRDWeb%252FConsentCallback%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Fadminconsent%3Fclient_id%3D5a0aa725-4958-4b0c-80a9-34562e23f3b7%26amp%3Bredirect_uri%3Dhttps%253A%252F%252Frdweb.wvd.microsoft.com%252FRDWeb%252FConsentCallback%3C%2FA%3E%3C%2FLI%3E%3CLI%3ESign%20in%20to%20the%20Windows%20Virtual%20Desktop%20consent%20page%20with%20a%20global%20administrator%20account.%3C%2FLI%3E%3CLI%3EClick%20Accept%3C%2FLI%3E%3CLI%3EWait%20a%20minute%20for%20Azure%20AD%20to%20record%20consent%3C%2FLI%3E%3CLI%3EOpen%20a%20browser%20and%20begin%20the%20admin%20consent%20flow%20to%20the%20Windows%20Virtual%20Desktop%20client%20app.%20%3CA%20href%3D%22https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Fadminconsent%3Fclient_id%3Dfa4345a4-a730-4230-84a8-7d9651b86739%26amp%3Bredirect_uri%3Dhttps%253A%252F%252Frdweb.wvd.microsoft.com%252FRDWeb%252FConsentCallback%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Fadminconsent%3Fclient_id%3Dfa4345a4-a730-4230-84a8-7d9651b86739%26amp%3Bredirect_uri%3Dhttps%253A%252F%252Frdweb.wvd.microsoft.com%252FRDWeb%252FConsentCallback%3C%2FA%3E%3C%2FLI%3E%3CLI%3ESign%20in%20to%20the%20Windows%20Virtual%20Desktop%20consent%20page%20as%20global%20administrator%2C%20as%20you%20did%20in%20step%202%3C%2FLI%3E%3CLI%3ESelect%20Accept%3C%2FLI%3E%3C%2FOL%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1404297%22%20slang%3D%22en-US%22%3ERe%3A%20CAA20004%20-%20AADSTS65005%20-%20The%20app%20needs%20access%20to%20a%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1404297%22%20slang%3D%22en-US%22%3EBingo!%20Fixed%20my%20issue!%20So%20we%20still%20have%20to%20do%20the%20consents%20like%20with%20the%202019%20fall%20version.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1405840%22%20slang%3D%22en-US%22%3ERe%3A%20CAA20004%20-%20AADSTS65005%20-%20The%20app%20needs%20access%20to%20a%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1405840%22%20slang%3D%22en-US%22%3EConsent%20will%20not%20be%20needed%20with%20the%20Spring%20Update%20in%20general%20but%20this%20is%20a%20temporary%20workaround%20for%20the%20Windows%20client.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1407288%22%20slang%3D%22en-US%22%3ERe%3A%20CAA20004%20-%20AADSTS65005%20-%20The%20app%20needs%20access%20to%20a%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1407288%22%20slang%3D%22en-US%22%3EThanks%20David%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1411823%22%20slang%3D%22en-US%22%3ERe%3A%20CAA20004%20-%20AADSTS65005%20-%20The%20app%20needs%20access%20to%20a%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1411823%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F217952%22%20target%3D%22_blank%22%3E%40David%20Belanger%3C%2FA%3E%26nbsp%3BIs%20there%20a%20reason%20why%20we%20would%20have%20a%20mixed%20experience%20with%20the%20Windows%20Client%20issue%20mentioned%20here%3F%20I've%20heard%20that%20some%20have%20not%20needed%20to%20go%20through%20the%20grant%20consent%20process%20with%20the%20Spring%202020%20Update%2C%20but%20I%20just%20ran%20into%20an%20issue%20where%20I%20could%20not%20use%20the%20Windows%20client%20(HTML5%20client%20was%20fine)%20until%20I%20did%20that%20step.%20Is%20there%20something%20we%20can%20look%20for%20as%20an%20indicator%20of%20sorts%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1458630%22%20slang%3D%22en-US%22%3ERe%3A%20CAA20004%20-%20AADSTS65005%20-%20The%20app%20needs%20access%20to%20a%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1458630%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F673206%22%20target%3D%22_blank%22%3E%40ddasilva%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20deployed%20the%20Spring%20Update%20twice%20now%20and%20both%20times%20needed%20to%20do%20the%20consent%20due%20to%20the%20error%20on%20the%20Windows%20RD%20Client.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1460018%22%20slang%3D%22en-US%22%3ERe%3A%20CAA20004%20-%20AADSTS65005%20-%20The%20app%20needs%20access%20to%20a%20service%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1460018%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F307498%22%20target%3D%22_blank%22%3E%40gerry_1974%3C%2FA%3E%26nbsp%3BRecommend%20taking%20a%20look%20at%20this%20post%20and%20trying%20out%20the%20upcoming%20client.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fwindows-virtual-desktop%2Ffeedback-requested-changes-to-the-subscription-logic-for-the%2Fm-p%2F1451808%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fwindows-virtual-desktop%2Ffeedback-requested-changes-to-the-subscription-logic-for-the%2Fm-p%2F1451808%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Hello,


I've recently deployed WVD Spring 2020 and my users report the following error with the WVD client

"AADSTS65005 - The app needs access to a service.  https://mrs-prod.ame.gbl/mrs-RDInfra-prod"

 

Users report no issues using the HTML5 client.   What did I miss during the configuration process?

Note:  I've registered the Microsoft.DesktopVirtualization resource provider

 

How do I resolve this issue?

 

Thanks,

D

7 Replies
Highlighted
Best Response confirmed by ddasilva (Occasional Contributor)
Solution

Hello,

 

I realized that I did not provide consent for the WVD server and client app.  I believe the Spring 2020 documentation is missing references to provide consent.  Perhaps MS could update their r documentation to mitigate the issue with other clients? 

 

I fixed the issue by following the steps below (pulled from the Fall 2019 documentation):

 

  1. Open a browser and begin the admin consent flow to the Windows Virtual Desktop server app.  https://login.microsoftonline.com/common/adminconsent?client_id=5a0aa725-4958-4b0c-80a9-34562e23f3b7...
  2. Sign in to the Windows Virtual Desktop consent page with a global administrator account.
  3. Click Accept
  4. Wait a minute for Azure AD to record consent
  5. Open a browser and begin the admin consent flow to the Windows Virtual Desktop client app. https://login.microsoftonline.com/common/adminconsent?client_id=fa4345a4-a730-4230-84a8-7d9651b86739...
  6. Sign in to the Windows Virtual Desktop consent page as global administrator, as you did in step 2
  7. Select Accept
Highlighted
Bingo! Fixed my issue! So we still have to do the consents like with the 2019 fall version.
Highlighted
Consent will not be needed with the Spring Update in general but this is a temporary workaround for the Windows client.
Highlighted
Highlighted

@David Belanger Is there a reason why we would have a mixed experience with the Windows Client issue mentioned here? I've heard that some have not needed to go through the grant consent process with the Spring 2020 Update, but I just ran into an issue where I could not use the Windows client (HTML5 client was fine) until I did that step. Is there something we can look for as an indicator of sorts?

Highlighted

@ddasilva 

 

I've deployed the Spring Update twice now and both times needed to do the consent due to the error on the Windows RD Client.

Highlighted