Hybrid Worker deployment error: Authentication failed for private links

Question

Hello Azure Community

I'm trying to deploy an Extension Based Hybrid worker (Azure VM). The agent installs but then fails to register the service:

VERBOSE: [2022-05-25 09:06:58Z] Invoking HybridWorkerService Enable ...
WARNING: Error while reaching the Hybrid Worker server. Retrying it for : 1 time after waiting for 6 seconds
WARNING: Error while reaching the Hybrid Worker server. Retrying it for : 2 time after waiting for 12 seconds
WARNING: Error while reaching the Hybrid Worker server. Retrying it for : 3 time after waiting for 24 seconds
WARNING: Error while reaching the Hybrid Worker server. Retrying it for : 4 time after waiting for 48 seconds
WARNING: Error while reaching the Hybrid Worker server. Retrying it for : 5 time after waiting for 96 seconds
VERBOSE: [2022-05-25 09:10:13Z] Error encountered handling extension configuration...
VERBOSE: [2022-05-25 09:10:13Z] [ERROR] {"Message":"Authentication failed for private links"}

The VM is not public and within a private virtual network and has Internet access.

Private link/DNS zone created.

Any pointers will be greatly appreciated.

Thank you,
-Andrew

Answer 1

Hi @Andrew Kenny

Welcome to Microsoft Q&A! Thanks for posting the question.

I am assuming that you are trying to use a Windows VM as Hybrid worker and the Azure Automation account has a private endpoint enabled.- Please reply with the OS details, in case you are not using Windows VM.

Here are some of the troubleshooting guidelines which should help you:

1. Ensure that the machine meets the pre-requisite criteria as mentioned here.

2. While creating the "private endpoint", ensure that you have used "target sub-resource" as "DSCAndHybridWorker"

3. Ensure that the private end point of automation account is connected to the same Virtual Network, to which the Hybrid worker VM is connected. To ensure that they are the same, please check the following:

a. Go to Azure Automation Account --> Networking --> "Private access" tab
b. Select the endpoint --> "Virtual network/subnet" --> Note the "Virtual network ID"
c. Got to the Hybrid Worker VM --> Networking --> select the "Virtual network/subnet"
d. Ensure that the virtual network ID is identical for step b. and c. above. I ran into similar issues when I had accidentally enabled endpoint for Azure Automation account to a different Virtual Network.

4. Ensure that "System Assigned Identity" is enabled on Hybrid worker VM.

In case the steps above don’t help, the following troubleshooting guidelines should help you: Troubleshoot Extension based Hybrid worker.

If the steps/information above do not help, can you please share details about the steps taken to install the extension-based hybrid worker role (ARM/PowerShell/Portal etc.). Also, please let me know if you are using proxy to communicate with Automation Endpoints or have a firewall in place. This link contains information about firewall usage/ports and URLs required.

Please let me know if you have any questions.

---
Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.

Answer 2

It turned out to be incorrect private DNS records:

Once we updated to the correct private link IP addresses, the extension registered.

Answer 3

Had this issue. Was due to using my Active Directory's DNS instead of Azure's 168.63.129.16. Created Conditional Forwarded in AD DNS to point azure-automation.net to 168.63.129.16