Access denies

Question

Hi,

Im trying to start my task assessment however i see access denied message. Can you please share the steps I need to take to start the task assessment

Answer 1

Hi 38151034,

I understand you're seeing an "Access denied" message when trying to start your task assessment, and I'd be happy to help.

Have you already tried the Q&A Assist suggestions? In addition, could you please confirm:

• What assessment are you trying to start (Microsoft Learn, certification exam, job application, school/work training, etc.)?
• Where do you see the “Access denied” message (website URL, app, or screenshot if possible)?
• Are you signed in with a personal Microsoft account or a work/school account?

As a quick test, if this is an online assessment in a web browser, please try:

• Open an InPrivate/Incognito window.
• Sign in to the assessment site again.
• Try a different browser (Microsoft Edge or Chrome).
• Temporarily disable any VPN or proxy connection and test again.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

To start an assessment task and resolve the “Access is denied” message, check both Task Scheduler permissions and the assessment’s own requirements.

1. Confirm the account has required permissions
   • The account running the assessment must meet the assessment’s prerequisite permissions for that specific assessment type (for example, Entra ID, SharePoint, etc.).
   • Review the prerequisite/getting started document for the assessment being configured and ensure the account and environment configuration are complete.
2. Fix Task Scheduler “Access is denied” for the task If Windows Task Scheduler shows an “Access is denied” error when starting the assessment task:
   1. Make sure the account used to run or manage the task is a local administrator (or domain administrator if managing remotely). Non‑administrator users cannot manage tasks created by other users.
   2. Ensure the task is configured to run with the correct user credentials (the same assessment account that has the required permissions).
   3. Verify that permissions on C:\Windows\System32\Tasks have not been changed in a way that blocks the account from running the task.
3. Verify “Log on as a batch job” right The assessment task may not trigger if the account lacks the “Log on as a batch job” right:
   1. Open gpedit.msc on the data collection machine.
   2. Go to Computer Configuration → Windows Settings → Security Settings → Local Policies → User Rights Assignment.
   3. Open Log on as a batch job → Add User or Group and add the assessment account.
4. Check additional local policies that can block the task On the data collection machine, review these policies if the assessment still fails:
   • Don’t forcefully unload the user registry at user logoff
     1. Open gpedit.msc.
     2. Go to Computer Configuration → Administrative Templates → System → User Profiles.
     3. Set Don’t forcefully unload the user registry at user logoff to Enabled.
   • Disable FIPS policy (if enabled and causing issues)
     1. Open Control Panel → Administrative Tools → Local Security Policy.
     2. Go to Local Policies → Security Options.
     3. Find System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing and set it to Disabled.
   • Network access: Do not allow storage of passwords and credentials for network authentication
     • If seeing the error “A specified logon session does not exist. It may already have been terminated.”:
       1. Open secpol.msc.
       2. Go to Security Settings → Local Policies → Security Options.
       3. Set Network access: Do not allow storage of passwords and credentials for network authentication to Disabled.
5. Confirm the assessment scheduled task exists and is configured
   • For Entra ID assessments, the setup script creates a scheduled task named AzureAssessment under:
     • Task Scheduler Library → Microsoft → Operations Management Suite → AOI* → Assessments → AzureAssessment.
   • For SharePoint assessments, the task is named SharePointAssessment under the same path.
   • Ensure the task exists, is enabled, and is configured to run with the correct assessment account.
   • The task normally runs within an hour of setup and then every seven days, but it can be started manually from Task Scheduler if permissions are correct.
6. Ensure the assessment is added in Services Hub (for On‑Demand Assessments)
   • If starting the assessment via PowerShell (for example, Start‑XXXAssessment) fails with a message that no assessment package is associated with the workspace, add the assessment in Services Hub:
     1. Go to Services Hub → Health → Assessments.
     2. Under Available On‑Demand Assessments, select the required assessment.
     3. Select Add Assessment and wait 5–10 minutes for the solution extension to be added.

If, after these steps, access is still denied when starting the assessment task, use the assessment‑specific troubleshooting guide for On‑Demand Assessments or open a support case with the Services Hub Support team as indicated in the documentation.

---

References:

• "Access Denied" error when using Task Scheduler
• Troubleshooting the On-Demand Assessments (AMA)
• Getting Started - Microsoft Entra ID On-Demand Assessment
• Getting Started with the SharePoint On-Demand Assessment
• Creation of the Assessment Scheduled Task - Microsoft Engage Center