Error Windows Admin Center extension on Azure Local

Question

Error Windows Admin Center extension on Azure Local

Luke 95

This morning, we noticed an error on our Azure Local two-node-cluster. To troubleshoot, we uninstalled the Windows Admin Center extension from both nodes and attempted to manually reinstall it. However, during reinstallation, we encountered the following error message:

'Extension Message: Executing Enable operation, SettingDnsRecords: Creating/updating DNS records, GetDataFromMetadataService: Getting data from Azure metadata service, GetInstanceMetadataForArc: Retrieving the virtual machine instance metadata information, GettingWacPort: Getting Windows Admin Centers configured port, UpdatingWindowsAdminCenterConfiguration: Updating Windows Admin Center Configuration, StoppingWindowsAdminCenterService: Stopping Windows Admin Center service, UpdatingInstallationTypeSettings: Updating Installation type for Windows Admin Center, UpdatingCSPSettings: Updating CSP Frame Ancestors for Windows Admin Center, UpdatingCORSSettings: Updating CORS origins for Windows Admin Center, UpdatingPort: Updating port for Windows Admin Center, UpdatingWebSocketValidationOverride: Updating WebSocket validation override settings, UpdatingTokenAuthenticationEnabled: Updating token authentication setting, UpdatingAutoUpdate: Updating auto update setting, SettingProxy: Updating proxy for Windows Admin Center, GettingWacPort: Getting Windows Admin Centers configured port, UpdatingWindowsAdminCenterConfiguration: Updating Windows Admin Center Configuration, GetDataFromMetadataService: Getting data from Azure metadata service, GetInstanceMetadataForArc: Retrieving the virtual machine instance metadata information, TestWACAppServiceReachability: Testing reachability of Application Web Service of Windows Admin Center, GetAccessTokenForArc: Failed to get access token from Azure Arc's identity endpoint, RetrieveCertificate: Retrieving certificate from key vault using app service'

Nikhil Duserla 9,945 Reputation points Microsoft External Staff Moderator

2025-09-23T12:43:39.6866667+00:00
Hello @Luke,

The Network Service account is expected to have permissions to run services like Windows Admin Center (WAC). When WAC is installed via the Azure portal either at the cluster or individual node level it sets the WindowsAdminCenter service to run as NT AUTHORITY\NetworkService by default.

I was trying to test your case from my end, and immediately after installation (build 11.2504.1001.19), the service was present but would not start. There were no modifications or domain policies in place this was a clean, standalone deployment in Azure.

After RDPing into the VM and inspecting the service settings (services.msc), I observed that switching the Log On As user from Network Service to Local System allowed the service to start successfully. This behavior was consistent across multiple attempts.

The root cause here appears to be that although Network Service is a built-in account with limited privileges, in some Azure-based or cloud-init provisioning contexts (even for standalone nodes), it doesn't get the necessary “Log on as a service” right applied automatically. This may be due to baseline security templates, the default local security policy, or how the WAC MSI gets invoked by the Azure extension agent.

How to fix it?

Assuming you have already created a VM (in this example I have used Windows Server 2022 VM Win2022Datacenter) in Azure.

Install WAC via the Azure Portal by enabling the “Windows Admin Center” extension.

Change the service account to LocalSystem using this PowerShell command:

$svc = Get-WmiObject -Class Win32_Service -Filter "Name='WindowsAdminCenter'" $svc.Change($null, $null, $null, $null, $null, $null, "LocalSystem", $null) Restart-Service WindowsAdminCenter

The service will start, and the WAC portal loads without issues.

In short, you're not missing anything. Your understanding is correct in theory, but in practice, the Network Service account may lack the necessary rights under certain WAC installation paths, especially those triggered through Azure. Switching to Local System is a valid and safe workaround unless a GPO or security baseline is enforcing something more restrictive.

reference document- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/log-on-as-a-service

If you have any further queries, do let us know.
Veselý, Ondřej 55 Reputation points

2025-09-23T19:58:47.1+00:00

This was the correct workaround up until yesterday, this workaround stoped working with the new update 2509.

I am not sure if 2509 make the workaround stop working OR if it introduced a new second issue.

As of now I have exactly the same issue after updating to 2509, and the old workaround with changing the service to start as a Local System is no longer working during the reinstalation:
Extension Message: Executing Enable operation, SettingDnsRecords: Creating/updating DNS records, GetDataFromMetadataService: Getting data from Azure metadata service, GetInstanceMetadataForArc: Retrieving the virtual machine instance metadata information, GettingWacPort: Getting Windows Admin Centers configured port, GettingCSPFrameAncestors: Getting Windows Admin Center configured CSP frame ancestors, UpdatingWindowsAdminCenterConfiguration: Updating Windows Admin Center Configuration, StoppingWindowsAdminCenterService: Stopping Windows Admin Center service, UpdatingInstallationTypeSettings: Updating Installation type for Windows Admin Center, UpdatingCSPSettings: Updating CSP Frame Ancestors for Windows Admin Center, UpdatingCORSSettings: Updating CORS origins for Windows Admin Center, UpdatingPort: Updating port for Windows Admin Center, UpdatingWebSocketValidationOverride: Updating WebSocket validation override settings, UpdatingTokenAuthenticationEnabled: Updating token authentication setting, UpdatingAutoUpdate: Updating auto update setting, SettingProxy: Updating proxy for Windows Admin Center, GettingWacPort: Getting Windows Admin Centers configured port, UpdatingWindowsAdminCenterConfiguration: Updating Windows Admin Center Configuration, GetDataFromMetadataService: Getting data from Azure metadata service, GetInstanceMetadataForArc: Retrieving the virtual machine instance metadata information, TestWACAppServiceReachability: Testing reachability of Application Web Service of Windows Admin Center, GetAccessTokenForArc: Failed to get access token from Azure Arc's identity endpoint, RetrieveCertificate: Retrieving certificate from key vault using app service
Luke 95 Reputation points

2025-09-23T22:40:56.8166667+00:00

still working on the issues now
Luke 95 Reputation points

2025-09-23T22:41:49.58+00:00

A bit more details:

We were trying to install the WAC extension with version 0.42.0.0 which was previously running well for a long while on our two-nodes-cluster.

We used the same powershell script to manually install the extension from cluster level.

https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/manage-hci-clusters#:~:text=on%20your%20cluster.-,Automate%20Windows%20Admin%20Center%20deployment%20using%20PowerShell,-You%20can%20automate

Not sure if we missed any role assignments or something else we might can try
Veselý, Ondřej 55 Reputation points

2025-09-23T22:54:23.5+00:00

What version is your cluster?
Luke 95 Reputation points

2025-09-23T23:00:26.6833333+00:00

current version 10.2411.1.10

We haven't upgraded the cluster yet, as we preferring fixing the extension issue first.

The reason why we want to use 0.42.0.0 WAC extension is above 0.49.0.0, there are known-issues. Thus, we stick with the old extension version which was running well for a long while.
Veselý, Ondřej 55 Reputation points

2025-09-23T23:02:38.57+00:00

Interesting, I run WAC 0.62.0.0 and cluster 2509 and started having exactly the same issue around the same time 22.9. late night/23.9. early morning.

However only one of my two clusters seems to be affected, my second cluster on the same version is just fine(for now).
Luke 95 Reputation points

2025-09-23T23:36:57.8+00:00

We have a two-node-cluster, first time we notice there is extension error is only on node02. We even tried to use WAC on node01, and surprisingly, it was working well.

To try fix, we uninstalled WAC from cluster level, which means it would be removed from both nodes, then the re-installation fails now on both nodes.
Veselý, Ondřej 55 Reputation points

2025-09-23T23:44:17.2133333+00:00

I have two 4 node clusters, on one all 4 nodes started having issues at the same time, so I tried to uninstall and reinstall from the portal and now I am getting this error, my second cluster still runs fine.

Strangely enough, we are noot the only ones, and everybody started having the same issue around the same time, which makes me wonder, if it is related to the Key Vault service and not the WAC itself, because I dont know how this could happen to multiple people, on multiple versions at the same time.
Need to scroll down to the last comment.
https://learn.microsoft.com/en-us/answers/questions/5534367/how-to-set-up-wac-on-an-azure-local-cluster
Peter Mavrakis 20 Reputation points

2025-09-24T17:52:36.7166667+00:00

Having the same issue on cluster version 11.2509.1001.21
Ashton Pillay 0 Reputation points

2025-09-25T08:19:42.6633333+00:00

Having the same issue after upgrading to 12.2509.1001.22 with a 4 node clusters.
Nikhil Duserla 9,945 Reputation points Microsoft External Staff Moderator

2025-09-25T19:57:10.69+00:00

Hello Luke,

I am working on it will get back to you!
Veselý, Ondřej 55 Reputation points

2025-09-30T01:10:36.8766667+00:00

Did anybody have a luck solving this?
I am trying to deal with this since the release, together with support, but no luck...

So, far I did not see anybody on 2509 for who this would work.
Yet, somehow it is still not as known issue in the release notes:

https://learn.microsoft.com/en-us/azure/azure-local/known-issues?view=azloc-2509&preserve-view=true

Is this actually working for ANYBODY on 2509?
Luke 95 Reputation points

2025-09-30T01:13:53.2+00:00

Hi Vesely, no luck, we're also working on it now. Could you please help converting this from 'accepted answer' to 'comment', which might help others to keep contributing this issue. Thank you.
Veselý, Ondřej 55 Reputation points

2025-09-30T01:19:34.94+00:00

Sorry converted, new here... :)

I will say that support pointed out to the fact that WAC in Azure Portal is considered Preview feature, so it is a low priority and fix might take a while...

Which means we might be forced to use the old school WAC, which at least for me is still working without issues, if that helps.
Werner d'Exelle 0 Reputation points

2025-09-30T14:50:49.4066667+00:00

Can confirm that on my lab setup with 2 AX nodes, after 2509, WAC extension also breaks. But to comment on the workaround to change the service account to System, is not something I had to do. What I found is that WDAC = enforced would totally screw up the install. Putting it in audit mode first, then push the WAC extension and once that's all green on the azure portal, then enable wdac enforced again, would keep it working.

So for me, Microsoft WDAC is blocking Microsoft WAC.... until today, when 0.62.0.0 just bugs out after (11.)2509
Veselý, Ondřej 55 Reputation points

2025-10-01T10:25:57.9566667+00:00

There is now new WAC version 0.66.0.0 which could fix this, however it is not yet available in my region, so I am not able to test it yet.
Werner d'Exelle 0 Reputation points

2025-10-02T09:49:20.06+00:00

Hmm, where did you pick that up? This page: https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/extension-release-notes is horribly outdated...
Veselý, Ondřej 55 Reputation points

2025-10-02T10:20:33.9133333+00:00

From the Microsoft support team, I do have open ticket with them on this.
Jimmy Lindö 0 Reputation points

2025-10-04T10:37:53.2166667+00:00

Which regions is 0.66 available in? Did you get instruction how to force installation of this version?
Jonas Borjesson 0 Reputation points

2025-10-07T10:17:44.54+00:00

Any new's?
Luke 95 Reputation points

2025-10-07T22:33:35.2666667+00:00

Hi Nikhil, I tried to install WAC extension via Azure Portal by simply clicking the 'setup' button 3 days ago. However, it still came to install 0.62 version. May I check when is 0.66 released in the region Australia East? Thank you.

Veselý, Ondřej 55

0.66.0.0 got released in my region today and it fixed the issue for me on both clusters.

If 0.66.0.0 is availible in your region, but you are still getting 0.62.0.0 when using the portal, try this script if it will force 0.66.0.0 for you:

# Pre-filled variables
$SubID = "your subcription ID"
$TenantID = "your tenant ID"
$RGname = "your resource group name"
$Location = "your location"
$AdminAccount = "your admin account name"

# Prompt for optional values
[string]$port = Read-Host "Enter TCP port to use (default is 6516)"
if ([string]::IsNullOrWhiteSpace($port)) {
    $port = "6516"
}

$extensionVersion = Read-Host "Enter the extension version (e.g., 0.47.0.0)"
if ([string]::IsNullOrWhiteSpace($extensionVersion)) {
    $extensionVersion = "0.66.0.0"
}

# Prepare settings
$Settings = @{ "port" = $port }

# Get cluster name
$clusterName = (Get-Cluster).Name

# Authenticate using specific account
Connect-AzAccount -UseDeviceAuthentication `
    -AccountId $AdminAccount `
    -Tenant $TenantID `
    -Subscription $SubID

# Install extension
New-AzStackHciExtension -ArcSettingName "default" `
    -Name "AdminCenter" `
    -ResourceGroupName $RGname `
    -ClusterName $clusterName `
    -ExtensionParameterPublisher "Microsoft.AdminCenter" `
    -ExtensionParameterSetting $Settings `
    -ExtensionParameterType "AdminCenter" `
    -SubscriptionId $SubID `
    -ExtensionParameterTypeHandlerVersion $extensionVersion

# Enable connectivity
$patch = @{ "properties" = @{ "connectivityProperties" = @{ "enabled" = $true } } }
$patchPayload = ConvertTo-Json $patch -Depth 5

Invoke-AzRestMethod -Method PATCH `
    -Uri "https://management.azure.com/subscriptions/$SubID/resourceGroups/$RGname/providers/Microsoft.AzureStackHCI/clusters/$clusterName/ArcSettings/default?api-version=2023-02-01" `
    -Payload $patchPayload

Luke 95 Reputation points

2025-10-08T01:19:30.5233333+00:00

Hi Veselý, thank you for sharing that. Definitely will give it a try.

Currently I have an error during cluster solution update. The cluster is still running at this moment, but not sure if it's good time to test to install WAC extension on it now.
Luke 95 Reputation points

2025-10-08T01:48:31.02+00:00

a quick update:
I've manually installed WAC extension on Azure Local two-nodes-cluster. The current status is successful.

Some details, which might look a bit weird.
1)Access WAC preview portal via two-nodes-cluster, is not working. After clicking 'connect', nothing happens. Then I spent a few minutes to refresh the page many times. It works properly now.

2)Access WAC preview portal via Node 1, it's working perfect at this first time.

3)Access WAC preview portal via Node 2, not working and throw an error. Then I spent a few minutes to refresh the page many times. It works properly now.

To sum up, despite some other minor issues, the version 0.66.0.0 is working.
Veselý, Ondřej 55 Reputation points

2025-10-08T03:03:26.35+00:00

For the point one, at least for me that has been the case for a long time, to a point that I dont really even remember with which version it started doing that but its definitelly not an issue on your end.

4 answers

Your answer

Luke 95 Reputation points

2025-09-23T22:40:56.8166667+00:00

still working on the issues now
Luke 95 Reputation points

2025-09-23T22:41:49.58+00:00

A bit more details:

We were trying to install the WAC extension with version 0.42.0.0 which was previously running well for a long while on our two-nodes-cluster.

We used the same powershell script to manually install the extension from cluster level.

https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/manage-hci-clusters#:~:text=on%20your%20cluster.-,Automate%20Windows%20Admin%20Center%20deployment%20using%20PowerShell,-You%20can%20automate

Not sure if we missed any role assignments or something else we might can try
Veselý, Ondřej 55 Reputation points

2025-09-23T22:54:23.5+00:00

What version is your cluster?
Luke 95 Reputation points

2025-09-23T23:00:26.6833333+00:00

current version 10.2411.1.10

We haven't upgraded the cluster yet, as we preferring fixing the extension issue first.

The reason why we want to use 0.42.0.0 WAC extension is above 0.49.0.0, there are known-issues. Thus, we stick with the old extension version which was running well for a long while.
Veselý, Ondřej 55 Reputation points

2025-09-23T23:02:38.57+00:00

Interesting, I run WAC 0.62.0.0 and cluster 2509 and started having exactly the same issue around the same time 22.9. late night/23.9. early morning.

However only one of my two clusters seems to be affected, my second cluster on the same version is just fine(for now).
Luke 95 Reputation points

2025-09-23T23:36:57.8+00:00

We have a two-node-cluster, first time we notice there is extension error is only on node02. We even tried to use WAC on node01, and surprisingly, it was working well.

To try fix, we uninstalled WAC from cluster level, which means it would be removed from both nodes, then the re-installation fails now on both nodes.
Veselý, Ondřej 55 Reputation points

2025-09-23T23:44:17.2133333+00:00

I have two 4 node clusters, on one all 4 nodes started having issues at the same time, so I tried to uninstall and reinstall from the portal and now I am getting this error, my second cluster still runs fine.

Strangely enough, we are noot the only ones, and everybody started having the same issue around the same time, which makes me wonder, if it is related to the Key Vault service and not the WAC itself, because I dont know how this could happen to multiple people, on multiple versions at the same time.
Need to scroll down to the last comment.
https://learn.microsoft.com/en-us/answers/questions/5534367/how-to-set-up-wac-on-an-azure-local-cluster
Peter Mavrakis 20 Reputation points

2025-09-24T17:52:36.7166667+00:00

Having the same issue on cluster version 11.2509.1001.21
Ashton Pillay 0 Reputation points

2025-09-25T08:19:42.6633333+00:00

Having the same issue after upgrading to 12.2509.1001.22 with a 4 node clusters.
Nikhil Duserla 9,945 Reputation points Microsoft External Staff Moderator

2025-09-25T19:57:10.69+00:00

Hello Luke,

I am working on it will get back to you!
Veselý, Ondřej 55 Reputation points

2025-09-30T01:10:36.8766667+00:00

Did anybody have a luck solving this?
I am trying to deal with this since the release, together with support, but no luck...

So, far I did not see anybody on 2509 for who this would work.
Yet, somehow it is still not as known issue in the release notes:

https://learn.microsoft.com/en-us/azure/azure-local/known-issues?view=azloc-2509&preserve-view=true

Is this actually working for ANYBODY on 2509?
Luke 95 Reputation points

2025-09-30T01:13:53.2+00:00

Hi Vesely, no luck, we're also working on it now. Could you please help converting this from 'accepted answer' to 'comment', which might help others to keep contributing this issue. Thank you.
Veselý, Ondřej 55 Reputation points

2025-09-30T01:19:34.94+00:00

Sorry converted, new here... :)

I will say that support pointed out to the fact that WAC in Azure Portal is considered Preview feature, so it is a low priority and fix might take a while...

Which means we might be forced to use the old school WAC, which at least for me is still working without issues, if that helps.
Werner d'Exelle 0 Reputation points

2025-09-30T14:50:49.4066667+00:00

Can confirm that on my lab setup with 2 AX nodes, after 2509, WAC extension also breaks. But to comment on the workaround to change the service account to System, is not something I had to do. What I found is that WDAC = enforced would totally screw up the install. Putting it in audit mode first, then push the WAC extension and once that's all green on the azure portal, then enable wdac enforced again, would keep it working.

So for me, Microsoft WDAC is blocking Microsoft WAC.... until today, when 0.62.0.0 just bugs out after (11.)2509
Veselý, Ondřej 55 Reputation points

2025-10-01T10:25:57.9566667+00:00

There is now new WAC version 0.66.0.0 which could fix this, however it is not yet available in my region, so I am not able to test it yet.
Werner d'Exelle 0 Reputation points

2025-10-02T09:49:20.06+00:00

Hmm, where did you pick that up? This page: https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/extension-release-notes is horribly outdated...
Veselý, Ondřej 55 Reputation points

2025-10-02T10:20:33.9133333+00:00

From the Microsoft support team, I do have open ticket with them on this.
Jimmy Lindö 0 Reputation points

2025-10-04T10:37:53.2166667+00:00

Which regions is 0.66 available in? Did you get instruction how to force installation of this version?
Jonas Borjesson 0 Reputation points

2025-10-07T10:17:44.54+00:00

Any new's?
Luke 95 Reputation points

2025-10-07T22:33:35.2666667+00:00

Hi Nikhil, I tried to install WAC extension via Azure Portal by simply clicking the 'setup' button 3 days ago. However, it still came to install 0.62 version. May I check when is 0.66 released in the region Australia East? Thank you.
Veselý, Ondřej 55 Reputation points

2025-10-08T01:02:38.17+00:00

0.66.0.0 got released in my region today and it fixed the issue for me on both clusters.

If 0.66.0.0 is availible in your region, but you are still getting 0.62.0.0 when using the portal, try this script if it will force 0.66.0.0 for you:

# Pre-filled variables $SubID = "your subcription ID" $TenantID = "your tenant ID" $RGname = "your resource group name" $Location = "your location" $AdminAccount = "your admin account name" # Prompt for optional values [string]$port = Read-Host "Enter TCP port to use (default is 6516)" if ([string]::IsNullOrWhiteSpace($port)) { $port = "6516" } $extensionVersion = Read-Host "Enter the extension version (e.g., 0.47.0.0)" if ([string]::IsNullOrWhiteSpace($extensionVersion)) { $extensionVersion = "0.66.0.0" } # Prepare settings $Settings = @{ "port" = $port } # Get cluster name $clusterName = (Get-Cluster).Name # Authenticate using specific account Connect-AzAccount -UseDeviceAuthentication ` -AccountId $AdminAccount ` -Tenant $TenantID ` -Subscription $SubID # Install extension New-AzStackHciExtension -ArcSettingName "default" ` -Name "AdminCenter" ` -ResourceGroupName $RGname ` -ClusterName $clusterName ` -ExtensionParameterPublisher "Microsoft.AdminCenter" ` -ExtensionParameterSetting $Settings ` -ExtensionParameterType "AdminCenter" ` -SubscriptionId $SubID ` -ExtensionParameterTypeHandlerVersion $extensionVersion # Enable connectivity $patch = @{ "properties" = @{ "connectivityProperties" = @{ "enabled" = $true } } } $patchPayload = ConvertTo-Json $patch -Depth 5 Invoke-AzRestMethod -Method PATCH ` -Uri "https://management.azure.com/subscriptions/$SubID/resourceGroups/$RGname/providers/Microsoft.AzureStackHCI/clusters/$clusterName/ArcSettings/default?api-version=2023-02-01" ` -Payload $patchPayload
Luke 95 Reputation points

2025-10-08T01:19:30.5233333+00:00

Hi Veselý, thank you for sharing that. Definitely will give it a try.

Currently I have an error during cluster solution update. The cluster is still running at this moment, but not sure if it's good time to test to install WAC extension on it now.
Luke 95 Reputation points

2025-10-08T01:48:31.02+00:00

a quick update:
I've manually installed WAC extension on Azure Local two-nodes-cluster. The current status is successful.

Some details, which might look a bit weird.
1)Access WAC preview portal via two-nodes-cluster, is not working. After clicking 'connect', nothing happens. Then I spent a few minutes to refresh the page many times. It works properly now.

2)Access WAC preview portal via Node 1, it's working perfect at this first time.

3)Access WAC preview portal via Node 2, not working and throw an error. Then I spent a few minutes to refresh the page many times. It works properly now.

To sum up, despite some other minor issues, the version 0.66.0.0 is working.
Veselý, Ondřej 55 Reputation points

2025-10-08T03:03:26.35+00:00

For the point one, at least for me that has been the case for a long time, to a point that I dont really even remember with which version it started doing that but its definitelly not an issue on your end.

Answer 1

I had to downgrade the installation and all work well now. Here my walkthrough

Last but not least: DISABLE AUTOUPGRADE on azure portal for this estension!

Scope & Assumptions

Machine is Azure Arc‑enabled and visible in Azure (resource type Microsoft.HybridCompute/machines).
You will operate only via Azure CLI (az), using the correct Arc resource location (e.g., westeurope). AdminCenter extension for Arc uses Publisher = Microsoft.AdminCenter and Type = AdminCenter (note: the type is not WindowsAdminCenter on Arc).

Replace the placeholders consistently:

<SUBSCRIPTION_ID>
<RESOURCE_GROUP>
<ARC_MACHINE_NAME>
<LOCATION> (Arc resource location, e.g. westeurope)

1) Set context

Shell

az account set --subscription "<SUBSCRIPTION_ID>"

2) Remove any failed/partial AdminCenter extension

Shell

az connectedmachine extension delete 
 --resource-group "<RESOURCE_GROUP>" 
 --machine-name "<ARC_MACHINE_NAME>" 
--name "AdminCenter"

3) Install AdminCenter v0.66.0.0 (Arc: publisher/type are critical)

Shell

az connectedmachine extension create 
 --resource-group "<RESOURCE_GROUP>" 
 --machine-name "<ARC_MACHINE_NAME>" 
--name "AdminCenter" 
--publisher "Microsoft.AdminCenter" 
--type "AdminCenter" 
 --type-handler-version "0.66.0.0" 
--location "<LOCATION>" 
--settings "{\"port\":6516}" 
 --force-update-tag "$(date -Iseconds)"

Publisher/Type must be exactly as above for Arc (Microsoft.AdminCenter / AdminCenter).
We explicitly pin 0.66.0.0 (see note on WDAC/Azure Local fix). [thomasmaurer.ch]
--settings provides a minimal valid body; --force-update-tag forces the Enable cycle. Managing VM extensions on Arc via CLI is documented by Microsoft.

4) (Optional) Re‑run the handler (“recheck”) without changing settings

If you adjusted anything locally (e.g., service startup) and want the extension to re‑evaluate:

Shell

az connectedmachine extension update 
 --resource-group "<RESOURCE_GROUP>" 
 --machine-name "<ARC_MACHINE_NAME>" 
--name "AdminCenter" 
--publisher "Microsoft.AdminCenter" 
--type "AdminCenter" 
--location "<LOCATION>" 
 --force-update-tag "$(date -Iseconds)"

This is the supported way to re‑trigger the handler on Arc machines. [learn.microsoft.com]

5) Verify in the Azure portal

Go to Azure Portal → Arc machine → Extensions + applications → AdminCenter and confirm Provisioning state = Succeeded. Managing WAC in the Azure portal for Arc is described here.
Open the Windows Admin Center blade and click Connect to launch the WAC session for the server.

TL;DR — Command block you actually need (with placeholders)

Shell

az account set --subscription "<SUBSCRIPTION_ID>"
az connectedmachine extension delete 
 --resource-group "<RESOURCE_GROUP>" 
 --machine-name "<ARC_MACHINE_NAME>" 
--name "AdminCenter"
az connectedmachine extension create 
 --resource-group "<RESOURCE_GROUP>" 
 --machine-name "<ARC_MACHINE_NAME>" 
--name "AdminCenter" 
--publisher "Microsoft.AdminCenter" 
--type "AdminCenter" 
 --type-handler-version "0.66.0.0" `
--location "<LOCATION>" 
--settings "{\"port\":6516}" `
 --force-update-tag "$(date -Iseconds)"
# (Optional) recheck after any local change
az connectedmachine extension update  `
 --resource-group "<RESOURCE_GROUP>" `
 --machine-name "<ARC_MACHINE_NAME>" `
--name "AdminCenter" `
--publisher "Microsoft.AdminCenter" `
--type "AdminCenter" `
--location "<LOCATION>" `
 --force-update-tag "$(date -Iseconds)"

Michael Palmquist 5 Reputation points

2026-02-03T19:39:40.2+00:00

Thanks for the input :)

I found a simpler approach :)
I successfully downgraded the extension to version 0.67.0.0 using the GUI.

I started by installing the latest version 0.70.0.0, then went into Settings and disabled automatic upgrades. After that, I selected version 0.67.0.0 and waited approximately 10 minutes for the process to complete.
Jshot 15 Reputation points

2026-02-03T20:09:45.66+00:00

"After that, I selected version 0.67.0.0 and waited approximately 10 minutes for the process to complete."

That part I don't follow - where in the GUI were you able to select a specific version?
Veselý, Ondřej 55 Reputation points

2026-02-03T20:19:47.98+00:00

For me what worked is to uninstall whatever version you have, switch WDAC to Audit mode using this command:
Enable-AsWdacPolicy -Mode Audit
Install Admin center latest version, and after that switched WDAC back to default using this command:
Enable-AsWdacPolicy -Mode Enforced
Jshot 15 Reputation points

2026-02-03T22:07:34.4233333+00:00

The 'az' command above to install the specific version worked for me - Windows Admin Center is now functioning
Dal Passo Fabrizio 35 Reputation points

2026-02-04T06:54:20.08+00:00

I don't know how to downgrade by using the GUI, it would be very useful if you share how to do it.
With my CLI commands I did the same thing you do, but the GUI would be definitely a simpler approach :-)
Michael Palmquist 5 Reputation points

2026-02-06T19:14:09.86+00:00

The downgrade process began by removing the Windows Admin Center extension from both hosts in Azure portal. After the removal, the extension (version 0.70.0.0) was installed by selecting “Windows Admin Center”. As soon as the installation status changed to “Succeeded,” the extension on both hosts was selected, and the Settings menu was opened to disable the Automatic update feature. Once automatic updates had been turned off, version 0.67.0.0 was chosen from the available version list and saved. It is important to complete this step quickly before extensions crash. All tasks were performed through the Azure Portal GUI. I have my Azure local in West Europe.

Answer 2

Luke 95

The new version of Windows Admin Center extension on Azure Local which is 0.66.0.0 can fix the issue.

0 comments

Answer 3

Jshot 15

I have the same issue, version 0.70.0.0: Failed to get access token from Azure Arc's identity endpoint, RetrieveCertificate: Retrieving certificate from key vault using app service

Anyone find a solution?

Dal Passo Fabrizio 35 Reputation points

2026-01-29T07:32:27.4433333+00:00

Same error here, on both my azure local clusters
Michael Palmquist 5 Reputation points

2026-01-29T14:30:10.36+00:00

I have also same error :(

Answer 4

Nikhil Duserla 9,945 Microsoft External Staff Moderator

Hello,

I have reached out our team and got to know the issue's fixed in version 0.66.0.0. I would say upgrade to the new version once it is available.

Region Version

AustraliaEast 0.66.0.0

CanadaCentral 0.66.0.0

EastUS 0.66.0.0

JapanEast 0.66.0.0

SoutheastAsia 0.62.0.0

WestEurope 0.62.0.0

other regions will be updated soon.

Thank you!

Bourret, Laurent 10 Reputation points

2026-02-25T14:43:54.72+00:00

With the 0.70 version the problem is the same
Bourret, Laurent 10 Reputation points

2026-02-25T14:45:31.7733333+00:00

i saw that now Admin center need a application azure to connect WAC to Azure with a certificate ?

Is it a new change ?

https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal#get-values-for-signing-in
Nikhil Duserla 9,945 Reputation points Microsoft External Staff Moderator

2026-02-26T12:28:31.6033333+00:00

Hello Bourret, Laurent,

Could you please create a new case on the Q&A forum and include all error details? One of our engineers will review it and assist you. Thank you!

https://learn.microsoft.com/en-us/answers/questions/ask/