Connection issues on pooled AVD Session Hosts in an Azure AD Only environment: ConnectionFailedAdErrorNoSuchMember

Hello Engel Bruno, B2B-INA-SES-WPS,

This behavior has been observed in Microsoft Entra–joined (Azure AD–only) pooled AVD environments and does not necessarily indicate a misconfiguration.

In Entra‑joined AVD session hosts, user access is evaluated at connection time using Azure RBAC. When a user connects, AVD dynamically validates the Virtual Machine User Login role and temporarily adds the user to the local Remote Desktop Users group. If the Entra ID object or RBAC permissions cannot be resolved quickly enough, the session host logs ConnectionFailedAdErrorNoSuchMember and NetLocalGroupAddMembers error 1387. Since this process is near‑real‑time and eventually consistent, the failure can occur sporadically and often succeeds on retry or on another pooled host.

This is why:

• The issue appears intermittently
• No configuration changes are required for it to recover
• Retrying the connection usually works

To reduce the occurrence, Microsoft’s recommended mitigation is:

• Assign Virtual Machine User Login at the resource group or subscription level, rather than per‑VM assignment
• Avoid VM‑level dynamic RBAC where possible in pooled host scenarios

This minimizes RBAC lookup and propagation timing issues during session start.

So yes—your suspicion is correct: this is related to timing and RBAC evaluation during session initiation, not a fault in your AVD, Entra join, or user configuration.

Hi @VEMULA SRISAI

Thank you for your confirmation.

We have already assigned the RBAC role to the recourse group, but the problem still occurs relatively frequently.

With Entra ID Only AVD Session Host I have to authorize the users with the RBAC Role "Virtual Machine User Login". Or is there another possibility?

Greetings, Bruno

I have a Info from Microsoft:

In Entra ID–only pooled AVD, nested groups can cause intermittent authorization failures due to identity propagation timing.

Microsoft recommends using a single, flat Entra ID security group with direct user membership for the Virtual Machine User Login role.

We use multiple nested Groups, and i will now try it with only one assigned group.

Engel Bruno, B2B-INA-SES-WPS Thanks for the update.

Yes, that information is correct. In Microsoft Entra ID–only pooled AVD environments, using nested security groups for the Virtual Machine User Login RBAC assignment can cause intermittent authorization failures due to identity and group membership propagation timing.

Microsoft recommends assigning the Virtual Machine User Login role to a single, flat Entra ID security group with direct user membership (no nested groups) to ensure stable and consistent access.

Testing with one directly assigned group is the right approach and should help mitigate the issue.

Engel Bruno, B2B-INA-SES-WPS I’m following up on my previous response to see if it helped. Please feel free to reach out if you need any further assistance—I’m happy to help.