Share via

Unknown error (500) in new web client when Workspace is set to private access

Laurens Bremers 25 Reputation points
2025-09-29T15:31:18.09+00:00

feeddiscovery fails with a 500 error in the new web client (windows.cloud.microsoft) when the Workspace resource is configured for private access.

This issue does not reproduce in the old web client (client.wvd.microsoft.com/arm/webclient/index.html).

  • Hostpool: private link configured + public access disabled
  • Workspace: private link configured + public access disabled
  • Endpoint device has line of sight to the private links. This setup has worked successfully for more than a year.
  • Old web client: no problems
  • New web client:
    • User logs into the web client
    • Initial feed discovery works. The SessionDesktop icon is visible
    • User selects the SessionDesktop
    • A new tab is opened automatically
    • Before the popup that asks about printer/clipboard/etc, an error occurs (sorry for the DutchUser's image )
    • Log file: Webclientlogboeken.txt 
          unknown_feed_discovery_error: Unknown error occurred while attempting feed discovery

I figured out it is the Workspace network configuration that is causing this, not the hostpool network config, because it does actually work when I set the Workspace to allow Public connections.

This issue is 100% reproducible.

Azure Virtual Desktop
Azure Virtual Desktop

A Microsoft desktop and app virtualization service that runs on Azure. Previously known as Windows Virtual Desktop.

Answer recommended by moderator

  1. Ankit Yadav 14,165 Reputation points Microsoft External Staff Moderator
    2025-09-30T00:31:16.8366667+00:00

    Hello @Laurens Bremers

    I worked with the engineering team, and it turns out that it's already listed out as the product limitation here:

    User's image

    reference: https://review.learn.microsoft.com/en-us/windows-app/troubleshoot-known-issues-limitations?branch=pr-en-us-488&tabs=web

    Additionally, please refer it here as well for web-browser support:

    User's image

    link: https://learn.microsoft.com/en-us/windows-app/compare-platforms-features?pivots=azure-virtual-desktop#network

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Alex Burlachenko 20,665 Reputation points MVP Volunteer Moderator
    2025-09-30T07:02:14.6766667+00:00

    Laurens hi,

    the error happens after the initial feed discovery but before the session starts. this suggests the new client is making an additional api call to a service that the old client did not use, and that service is not reachable over your private network.

    first, look at the network traffic from the endpoint device. use the browser's developer tools, f12, and go to the network tab. reproduce the error and look for any http call that fails with a 500 status code. the url of that failed request will tell you which specific service is unreachable. it is likely a new metadata or diagnostics service that the new client depends on.

    microsoft is constantly adding new features to avd, and sometimes the required backend services for a new client are not all covered by the original private endpoint configuration for the workspace. you might need to open a support ticket with microsoft to ask for the complete list of fully qualified domain names that the new web client requires for private link scenarios. their documentation might not have caught up yet.

    as a temporary workaround, while you investigate, you could create a specific dns rule. if you can identify the failing endpoint from the browser logs, you can create a conditional forwarder in your internal dns to resolve that specific hostname to its private ip address, if it has one.

    this kind of issue is not unique to azure. any time a platform rolls out a new client, it can have new dependencies that break in locked down environments. it is always a game of catch up for network security.

    so, to summarize. use the browser's f12 developer tools to find the exact url that is failing with a 500 error. that is your smoking gun. then, you can either adjust your private endpoint to include it or provide that information to microsoft support so they can fix their documentation or service.

    rgds,

    Alex

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.