Power Automate unattended flow fails with RdpPermissionNotGranted on Windows 365 Cloud PC, but attended mode works

Sai Teja Ponnuri 20 Reputation points
2026-10-12T08:39:11.2633333+00:00

Hello Community,

I am facing an issue running a Power Automate Desktop flow in unattended mode on a Windows 11 Windows 365 Cloud PC.

The same desktop flow works successfully in attended mode, but unattended execution fails with:

Plain Text

Error code: RdpPermissionNotGranted

Cannot create session to execute desktop flow run.

User needs to have Remote Desktop permissions.

Environment

  • Windows 11 Windows 365 Cloud PC
  • Microsoft Entra ID account used for Windows sign-in
  • Desktop flow triggered from a Power Automate cloud flow
  • Separate input variables used for the application/portal login

Troubleshooting performed

  • Checked Remote Desktop Users membership and Remote Desktop settings.
  • Reviewed Windows logon permissions and allow/deny user-right assignments.
  • Checked the desktop-flow connection and account configuration.
  • Signed out of the Cloud PC before triggering unattended execution.
  • Reviewed Power Automate service status and Windows event logs.
  • Tested disabling MFA, but the same error persisted.
  • Temporarily tested a UAC change and subsequently restored UAC.

The issue remains unresolved. The application login inputs are separate from the Windows session credentials, and the error occurs while attempting to create the unattended session.

Questions

  1. What additional checks can identify why the unattended session is being denied?
  2. Could an Intune/GPO setting or Entra authentication configuration cause this despite attended execution working?
  3. Which Power Automate logs and Windows events should I correlate to distinguish a permission failure from an authentication failure?

I can provide sanitized screenshots and relevant log extracts. Any guidance would be appreciated.

Windows for business | Windows Client for IT Pros | User experience | Remote desktop services and terminal services
0 comments
Answer accepted by question author
VPHAN 45,665 Reputation points Independent Advisor
2026-10-12T10:17:01.0633333+00:00

Hi Sai Teja Ponnuri,

To resolve the unattended execution failure on your Windows 365 Cloud PC, you must address how Windows handles Network Level Authentication with Microsoft Entra ID. Because unattended Power Automate flows cannot natively process modern Entra ID authentication prompts over a background remote desktop connection, the pre-authentication handshake fails and drops the session. You can resolve this by navigating to the Windows Registry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp and changing the UserAuthentication registry DWORD to 0. This disables the strict Network Level Authentication requirement, allowing the background service to successfully build the session. You must also ensure your desktop flow connection string utilizes the explicit AzureAD\ prefix before your user principal name to accurately route the credentials.

It is also crucial to verify that your mobile device management platform is not silently overriding your local machine configurations. Intune configuration profiles frequently supersede local settings, meaning an applied policy might be stripping the remote logon right or adding the background account to a deny list, even if your local security policy editor shows everything is configured correctly.

To pinpoint whether your connection block is a permission drop or an authentication failure, open the Windows Event Viewer and check the TerminalServices-LocalSessionManager operational log located under Applications and Services Logs, Microsoft, and then Windows. This log records the precise chronological sequence of remote session requests. Correlating the session drop events in this log with the exact timestamp of your flow execution will reveal the exact security layer terminating your connection.

Hope this answer has brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

VPHAN

Was this answer helpful?

2 people found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-10-12T08:39:36.6466667+00:00

    For RdpPermissionNotGranted in unattended mode, focus on the Windows session creation path rather than the application login. Attended mode succeeding does not validate unattended RDP session creation, because unattended runs create a separate remote desktop session and require specific rights.

    Recommended checks:

    1. Verify the unattended connection account can create an RDP session
      • Confirm the user specified in the desktop flow connection is in either Administrators or Remote Desktop Users on the Cloud PC.
      • On some environments, deny policies override group membership. Open Start > Run > secpol.msc and check:
        • Security Settings > Local Policies > User Rights Assignment > Deny log on locally
        • Security Settings > Local Policies > User Rights Assignment > Deny log on through Remote Desktop Services
      • Ensure these entries do not include the account used by the Power Automate service (UIFlowService).
    2. Confirm the machine can accept unattended RDP sessions
      • Verify Remote Desktop is enabled on the machine. If it is not, unattended runs can fail with RDPIsNotEnabled.
      • The user in the connection must have permission to create a remote desktop session. For unattended runs, Power Automate does not use the console session.
    3. Check for active session conflicts on Windows 11
      • Windows 10 and Windows 11 devices cannot run unattended desktop flows if any active Windows user session exists, even if locked.
      • Since sign-out was already tested, verify there are no remaining active sessions on the Cloud PC. The hosted machines guidance recommends checking Task Manager > Users and terminating other sessions, then signing out.
    4. Distinguish permission failure from authentication failure
      • RdpPermissionNotGranted indicates a remote desktop permission problem for session creation.
      • MSEntraLogonFailure is the documented unattended error for Microsoft Entra sign-in failure.
      • If the run consistently returns RdpPermissionNotGranted, prioritize local rights, Remote Desktop group membership, and deny-policy review before investigating application credentials or MFA.
    5. Check service-account-related session enumeration issues
      • If logs show SessionNotFoundAfterCreation instead of RdpPermissionNotGranted, the issue can be that UIFlowService lacks rights to enumerate remote sessions.
      • In that case, ensure the account running UIFlowService is in Remote Desktop Users and is not being removed by group policy.
    6. Correlate the right logs
      • Review Event Viewer for errors related to:
        • Power Automate for desktop
        • the machine
        • the target application
      • Correlate those events with the cloud flow run timestamp and the desktop flow run result.
      • If the machine-side events align with session creation or RDP rights failures, treat it as a permission issue. If the failure aligns with Entra sign-in errors, treat it as an authentication issue.
    7. Rule out machine/runtime instability
      • If different errors appear intermittently, also verify:
        • the machine has sufficient compute and memory
        • network connectivity is stable
        • the latest version of Power Automate for desktop is installed
    8. Isolate whether the problem is machine-specific or user-specific
      • Test the same unattended flow:
        • on another machine
        • with another Windows user on the same machine
      • Also sign in interactively with the unattended Windows user account and run the flow locally/attended to compare behavior.
      • If only one user fails, the problem is likely rights or policy assignment for that user. If all users fail on that Cloud PC, the issue is more likely machine configuration or policy.

    About Intune/GPO or Entra configuration:

    • Yes. The documented behavior supports that local or policy-based deny assignments can block unattended RDP session creation even when attended execution works.
    • The documented Entra-related unattended failure is MSEntraLogonFailure, while RdpPermissionNotGranted points to RDP/session rights.
    • On NLA-enabled VMs, unattended runs can also fail when using Microsoft Entra credentials unless NLA is disabled for unattended runs.

    Most likely next checks in this case:

    1. Reconfirm the exact account used by the desktop flow connection.
    2. Verify that account is in Remote Desktop Users or Administrators.
    3. In secpol.msc, verify no deny entries block Remote Desktop logon.
    4. In Task Manager > Users, confirm no active sessions remain.
    5. Compare Event Viewer timestamps with the failed run to determine whether the failure occurs at RDP session creation or Entra sign-in.
    6. If Microsoft Entra credentials are used for unattended access, check whether NLA is involved.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.