AVD RemoteApps fail with 0x3 / 0x410: Connection Broker can't validate RDP settings, but direct RDP works

I am troubleshooting an Azure Virtual Desktop RemoteApp deployment using an Azure Arc-enabled Windows session host.

The session host successfully registers with the AVD host pool and reports Available with AllowNewSession set to True. However, every RemoteApp launched through Windows App fails with:

Error Code: 0x3 Extended Error Code: 0x410

I have also received:

“Your computer can't connect to the remote computer because the Connection Broker couldn't validate the settings specified in your RDP file.”

The issue does not appear to be application-specific. I have tested multiple Autodesk applications as well as Notepad, and all produce the same error.

Troubleshooting and validation completed:

• The session host is successfully joined to Active Directory.
• The machine is also Microsoft Entra joined.
• DNS was corrected so the session host uses the Active Directory DNS server.
• Domain controller discovery succeeds with nltest.
• Direct/normal RDP to the server works successfully.
• The AVD session host reports Available.
• AllowNewSession is True.
• The AVD agent is installed and RDAgentBootLoader is running.
• The AVD rdp-sxs listener is present and in the Listen state.
• The standard rdp-tcp listener is also in the Listen state.
• fReverseConnectMode is set to 1.
• fEnableWinStation is set to 1.
• SessionDirectoryListener correctly references the installed rdp-sxs listener.
• The RemoteApp Application Group correctly references the intended host pool.
• The AVD workspace correctly references the RemoteApp Application Group.
• The host pool is configured as Pooled with RailApplications as the preferred application group type.
• Multiple RemoteApps have been tested, including a basic Notepad RemoteApp, with the same result.
• Any disconnected/stale user sessions were completely logged off before additional testing.
• Refreshing/testing the RemoteApps continues to produce the same behavior.

The most interesting part is what happens on the session host during an attempted Windows App connection.

The Remote Desktop Services event logs show that the AVD rdp-sxs listener receives the connection and user authentication succeeds. However, after authentication succeeds, a new user session is not created. Running quser after the failed connection does not show the user session.

The connection appears to progress like this:

Windows App → RemoteApp selected → Credential prompt → AVD rdp-sxs listener receives connection → User authentication succeeds → No user session is created → Connection fails with 0x3 / extended 0x410 or the Connection Broker RDP validation message

Since direct RDP works, the AVD session host is Available, authentication succeeds, and even Notepad fails as a RemoteApp, this appears to be related to the AVD broker/reverse-connect/session-establishment path rather than the published application itself.

Has anyone encountered a situation where the AVD broker successfully reaches the rdp-sxs listener and authenticates the user, but fails before creating the Windows session?