One user in Azure Virtual Desktop getting "Disconnected. Sign in failed." in Web app.

Question

We have one user in our Entra environment that is unable to login to our Hostpool. They get to the point where they accept all of the pop-ups and make the final connection before getting rejected.

No other users are have the same issue and all of the VDI machines accept new connections without issue.

• users are synced to Entra using Entra sync from on-prem AD
• Users connect to the VDI using the web app
• OS of the VDI machines is windows 11 22H2 and up to date on all patches.

There are no conditional access or MFA settings on this user that would impact them, and the Entra sign-in logs all show success.

Answer 1

Hello @Sarah Knickerbocker ,

First, assign the Virtual Machine User Login role to the user. Additionally, ensure that the user is included in the Application Group assignments.

To troubleshoot AVD VM that are in a Running state but report a Shutdown health status, begin by restarting the VM from the Azure portal to resolve any potential state inconsistencies. Additionally, verify the Azure VM Agent status to ensure it is running and up to date. If issues persist, consider resetting or upgrading the agent following the recommended steps provided in the Azure documentation.

In the Azure portal, go to AVD VM > Select Access Control (IAM) > Select Role Assignments > Confirm that the user account has been granted either the Virtual Machine User Login or Virtual Machine Administrator Login role.

Ensure that the RDP property targetisaadjoined:i:1 was added to the AVD host pool. To do this, navigate to the Azure portal > Select the host pool configured for Azure AD Join > Select the RDP Properties blade > Select the Advanced Tab > Add targetisaadjoined:i:1.

Disable security defaults by navigating to Entra ID > Manage > Properties > Manage Security Defaults > Disable.

Add Conditional Access policies to exclude the VM from MFA by adding the user.

Enable Conditional Access policies and exclude the users and groups as needed.

Hope this helps! Please let me know if you have any queries.

Answer 2

Hi Sarah,

since only one user is affected and Entra sign in logs show success, this is almost certainly not an authentication problem at Azure level. It is happening after token validation when AVD tries to create the session on the session host.

This error usually means one of these

1.The user is not properly assigned to the Application Group linked to the Host Pool. See the exact app group and confirm the user or a group they belong to is assigned.

2.The user profile is corrupted on the session host. If you are using FSLogix, check the profile container. Try deleting or renaming the users profile folder or VHDX and let it recreate. Corrupted profiles often cause instant disconnect after authentication.

3.The user account has restrictions on the session host, such as not being in Remote Desktop Users group locally, or being denied log on through Remote Desktop Services via local policy or GPO.

4.There could be a broken SID mapping if the user was recently recreated in on prem AD and synced again. If the SID changed, the session host may not map permissions correctly.

Check Event Viewer on one of the session hosts under Applications and Services Logs > Microsoft > Windows > TerminalServices and also Security log for failed logon attempts.

Since all other users work and host pool is healthy focus on that specific user account and profile. In most cases like this it turns out to be a corrupted FSLogix profile or missing app group assignment.

rgds,

Alex