User unable to launch pooled host session machines

If the pooled session hosts are Microsoft Entra joined, assign the affected user Virtual Machine User Login on the pooled VMs or their resource group; the existing Desktop Virtualization User assignment only authorizes access to the published application group.

1. Check the pooled hosts’ join type and VM-login role

In Azure portal → Azure Virtual Desktop → Host pools → pooled host pool → Session hosts, open a pooled VM and check its Microsoft Entra join state.

If the pooled VMs are Microsoft Entra joined:

1. Open the resource group containing the pooled VMs.
2. Select Access control (IAM) → Add → Add role assignment.
3. Select Virtual Machine User Login.
4. Assign the affected user, or preferably the same security group assigned to the pooled desktop application group.
5. Allow RBAC propagation, then have the user retry the connection.

Microsoft recommends assigning this role at the resource-group level so it applies to every VM in the host pool. A role assigned only to the personal VM would explain why personal desktop access works while pooled access fails.^1^

For host pools using a session host configuration, the additional VM role isn't required. It also isn't the documented access mechanism for AD DS or Microsoft Entra Domain Services joined hosts, so proceed to the next checks if either condition applies.

2. Verify the assignment is scoped to the pooled application group

Since the user can see and launch the pooled desktop, a missing feed assignment is less likely. Nevertheless, verify that the existing Desktop Virtualization User role is on the pooled host pool’s Desktop Application Group, rather than only the personal desktop application group:

1. Go to Azure Virtual Desktop → Application groups.
2. Open the desktop application group associated with the pooled host pool.
3. Select Assignments.
4. Confirm the affected user or a Microsoft Entra security group containing that user appears there.

The required role is scoped to the application group; an assignment on another application group doesn't grant access to this pooled desktop.^2^

You can inspect the user’s assignments with:

Get-AzRoleAssignment -SignInName "[Email]" |
    Where-Object {
        $_.RoleDefinitionName -in @(
            "Desktop Virtualization User",
            "Virtual Machine User Login"
        )
    } |
    Select-Object RoleDefinitionName, Scope

3. Check Conditional Access for this user

A user-specific policy can block the pooled connection even when resource assignment is correct.

1. Open Microsoft Entra admin center → Identity → Monitoring & health → Sign-in logs.
2. Filter by the affected user and the timestamp 2026-11-06 12:47 UTC.
3. Examine entries for:
   • Azure Virtual Desktop
   • Windows Cloud Login
4. Open each failed event and inspect:
   • Sign-in error code
   • Conditional Access tab
   • Authentication Details tab

These logs identify the exact policy or authentication requirement that blocked the connection.^3^

For Microsoft Entra joined session hosts, legacy per-user MFA isn't supported for VM sign-in; MFA should be enforced through correctly targeted Conditional Access policies instead.^4^

4. Determine whether the failure follows a particular pooled host

In Azure Virtual Desktop → Host pools → pooled host pool → Session hosts:

• Confirm each host reports Available and is accepting new sessions.
• Temporarily place one host in drain mode, retry, and repeat as necessary to determine whether failures occur only when the user is brokered to one particular VM.
• Use Azure Virtual Desktop Insights → User report to review this user’s connection history and identify the hosts and errors involved. Insights can report connectivity failures by user, host, resource, and client.^5^

If one host is implicated, inspect that VM under Event Viewer → Windows Logs → Application for these sources:

• WVD-Agent
• WVD-Agent-Updater
• RDAgentBootLoader
• MsiInstaller

If Remote Desktop Agent Loader is stopped, start it in services.msc. If event 3277 reports INVALID_REGISTRATION_TOKEN or EXPIRED_MACHINE_TOKEN, generate a new host-pool registration key and re-register that VM using Microsoft’s documented procedure.^6^

If the role scopes, Entra sign-in logs, and all pooled hosts are healthy, open an Azure support request under Azure Virtual Desktop and include the UTC timestamp, Activity ID, affected UPN, host pool, client version, and relevant AVD/Entra diagnostic events.^7^

References

1. Microsoft Entra joined session hosts in Azure Virtual Desktop
2. Deploy Azure Virtual Desktop (host-pool-session-host-configuration)
3. Troubleshoot single sign-on and Conditional Access for Azure Virtual Desktop
4. Troubleshoot connections to Microsoft Entra joined VMs
5. Azure Virtual Desktop Insights glossary
6. Troubleshoot common Azure Virtual Desktop Agent issues
7. Troubleshooting overview, feedback, and support for Azure Virtual Desktop