I can't use Windows Admin Center via the Azure Portal

Question

I can't use Windows Admin Center via the Azure Portal

TBFG Azure Admin 65

I am getting the following error when trying to use Windows Admin Center from my Azure Portal

I have added all the permissions and role, and installed extensions.

Any suggestions?

Couldn't start Windows Admin Center.

You are not authorized to access this tool. If you were recently given access, please wait a few minutes and try again. Learn more .

Error:You are not authorized to access this site. Please contact your administrator.

Pranitha Sika 0 Reputation points Microsoft External Staff Moderator

2026-07-06T10:38:56.8833333+00:00
Hello @TBFG Azure Admin ,

You’re running into that—this specific message from the Azure Portal (“You are not authorized to access this tool / Couldn’t start Windows Admin Center”) almost always comes down to the access/role prerequisites for using Windows Admin Center (WAC) from within Azure.

Here’s the practical checklist to work through:

What to check

Confirm you’re using the correct Azure account

Make sure the user trying to launch WAC from the Azure Portal is the same identity that was granted access (and not a different sign-in session).

Verify the required Azure permissions/roles are assigned

Even if you “added all the permissions and role,” double-check:

The role is assigned at the right scope (subscription / resource group / the specific VM/resource).

The assignment is to the user (or group) you’re using in the portal.

Allow time for role propagation

Azure RBAC changes can take a few minutes to become effective.

The error message itself recommends waiting—so try signing out and back in, or wait a bit and retry.

Confirm the Azure Portal has the WAC experience enabled for your tenant/subscription

You mentioned you installed extensions—still, WAC launching from the portal is also dependent on the platform-side authorization and configuration, not only VM extensions.

Can you please update us if the action plan provided was helpful?

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

If these answer your question, click "Upvote" which may be beneficial to other community members reading this thread.
TBFG Azure Admin 65 Reputation points

2026-07-08T07:55:35.9833333+00:00

Thanks Pranitha

Confirm you’re using the correct Azure account

We only have one account and that is the account we login as and access WAC

Verify the required Azure permissions/roles are assigned

We have run this through multiple AI agents and Google and added all of the recommended permission and roles

One of the main ones that comes up is 'Windows Admin Center Administrator Login' and that is definitely assigned

Confirm the Azure Portal has the WAC experience enabled for your tenant/subscription

How do I do this? WAC was available to be setup so I am assuming that it is.

You mentioned you installed extensions—still, WAC launching from the portal is also dependent on the platform-side authorization and configuration, not only VM extensions.

Not sure what this means? WAC is installed on the platform-side, but there is no access to it to check permissions.

Whenever we try and check via Port 6516 we get this

{"error":{"message":"File not found","code":"NotFound","detail":""}}
Pranitha Sika 0 Reputation points Microsoft External Staff Moderator

2026-07-09T10:45:44.5966667+00:00
Hello TBFG Azure Admin ,

Thank you for the detailed update.

Based on the information shared, the error message "Couldn't start Windows Admin Center: Not authorized to access this tool" appears to be related to an authorization or access validation check performed when launching Windows Admin Center (WAC) from the Azure Portal. While RBAC remains a possible factor, additional validation may be required to determine whether the issue is related to role assignments, authorization scope, or the portal-to-WAC integration.

To help further isolate the issue, could you please review the following:

Confirm the identity being used to launch WAC As you mentioned that only a single account is being used to access both the Azure Portal and Windows Admin Center, this helps reduce the likelihood of a user identity mismatch. Since the Windows Admin Center Administrator Login role has already been assigned, could you please sign out of the Azure Portal, sign back in, and attempt to launch WAC again? This will help ensure that any recent RBAC changes have fully propagated.

Validate the RBAC assignment scope We understand that the recommended role assignments have already been reviewed and applied. To verify the assignment scope, could you please confirm whether the Windows Admin Center Administrator Login role is assigned at the Subscription, Resource Group, or Virtual Machine level, and whether that scope includes the affected VM?

Verify WAC launch prerequisites The successful deployment of the Windows Admin Center extension confirms that the extension installation completed successfully. However, the Azure Portal launch process includes additional authorization and access validation checks beyond extension deployment. Reviewing the above RBAC and scope configurations will help determine whether any portal-side authorization requirements remain outstanding.

Port 6516 response The response returned from port **6516
** {"error":{"message":"File not found","code":"NotFound","detail":""}}
confirms that the endpoint is reachable and returning a response. However, this response alone does not provide sufficient information to determine whether the Azure Portal authorization flow for Windows Admin Center is functioning correctly. For this reason, we recommend continuing to investigate the authorization path, including role assignments, scope validation, and the account being used to access the Azure Portal.

Please let us know the RBAC assignment scope and the results of the above validation. Based on the findings, we will review the next appropriate troubleshooting steps.
TBFG Azure Admin 65 Reputation points

2026-07-09T23:21:10.2933333+00:00

Hi Pranitha

I have logged in and out of Azure several times, but it doesn't affect the result sorry.

Validate the RBAC assignment scope

https://prnt.sc/rUgc00vbqSK_

It is assigned at the Resource level
Pranitha Sika 0 Reputation points Microsoft External Staff Moderator

2026-07-13T18:28:50.8833333+00:00
Hello TBFG Azure Admin

Thank you for responding.

The "You are not authorized to access this tool" message can occur even when the required Azure roles are assigned correctly. Based on the provided RBAC configuration, the Windows Admin Center Administrator Login role is already assigned at the Virtual Machine resource level, which is the correct scope required to access Windows Admin Center.

This indicates that the issue is likely related to one of the following:

The Windows Admin Center extension is not installed correctly or is in a failed/unhealthy state.

Recent RBAC changes have not fully propagated across Azure services yet.

Required Windows Admin Center networking prerequisites are not being met.

A portal session, browser cache, or service-side validation issue is preventing successful authorization.

To resolve the issue, please perform the following steps:

Sign out of the Azure Portal and sign back in using the same account that has the Windows Admin Center Administrator Login role assigned. This ensures that any recent RBAC changes are refreshed and recognized by the service.

Navigate to VM → Extensions + Applications and verify that the Windows Admin Center extension is present and shows a Succeeded provisioning state.

If the extension is unavailable, failed, or unhealthy, reinstall the Windows Admin Center extension and retry the connection. Extension deployment issues can result in authorization-related access failures.

Confirm that the VM has the required outbound HTTPS connectivity to Azure services used by Windows Admin Center. Connectivity restrictions can prevent successful authentication and portal integration.

Retry accessing Windows Admin Center using an InPrivate/Incognito browser session to eliminate any browser cache or session-related issues.

Can you please update us if the action plan provided was helpful?

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

If these answer your question, click "Upvote" which may be beneficial to other community members reading this thread.
TBFG Azure Admin 65 Reputation points

2026-08-17T02:34:50.6733333+00:00

This is still an ongoing issue that has not been resolved. How do I contact Microsoft to be reviewed?

Everything in this thread is not setup as it should be but it is still not connecting.

Pranitha: I sent a reply your private message but I haven't heard back.

Any help would be appreciated.

4 answers

Your answer

Pranitha Sika 0 Reputation points Microsoft External Staff Moderator

2026-07-06T10:38:56.8833333+00:00

Hello @TBFG Azure Admin ,

You’re running into that—this specific message from the Azure Portal (“You are not authorized to access this tool / Couldn’t start Windows Admin Center”) almost always comes down to the access/role prerequisites for using Windows Admin Center (WAC) from within Azure.

Here’s the practical checklist to work through:

What to check

Confirm you’re using the correct Azure account

Make sure the user trying to launch WAC from the Azure Portal is the same identity that was granted access (and not a different sign-in session).

Verify the required Azure permissions/roles are assigned

Even if you “added all the permissions and role,” double-check:

The role is assigned at the right scope (subscription / resource group / the specific VM/resource).

The assignment is to the user (or group) you’re using in the portal.

Allow time for role propagation

Azure RBAC changes can take a few minutes to become effective.

The error message itself recommends waiting—so try signing out and back in, or wait a bit and retry.

Confirm the Azure Portal has the WAC experience enabled for your tenant/subscription

You mentioned you installed extensions—still, WAC launching from the portal is also dependent on the platform-side authorization and configuration, not only VM extensions.

Can you please update us if the action plan provided was helpful?

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

If these answer your question, click "Upvote" which may be beneficial to other community members reading this thread.
TBFG Azure Admin 65 Reputation points

2026-07-08T07:55:35.9833333+00:00

Thanks Pranitha

Confirm you’re using the correct Azure account

We only have one account and that is the account we login as and access WAC

Verify the required Azure permissions/roles are assigned

We have run this through multiple AI agents and Google and added all of the recommended permission and roles

One of the main ones that comes up is 'Windows Admin Center Administrator Login' and that is definitely assigned

Confirm the Azure Portal has the WAC experience enabled for your tenant/subscription

How do I do this? WAC was available to be setup so I am assuming that it is.

You mentioned you installed extensions—still, WAC launching from the portal is also dependent on the platform-side authorization and configuration, not only VM extensions.

Not sure what this means? WAC is installed on the platform-side, but there is no access to it to check permissions.

Whenever we try and check via Port 6516 we get this

{"error":{"message":"File not found","code":"NotFound","detail":""}}
TBFG Azure Admin 65 Reputation points

2026-07-09T23:21:10.2933333+00:00

Hi Pranitha

I have logged in and out of Azure several times, but it doesn't affect the result sorry.

Validate the RBAC assignment scope

https://prnt.sc/rUgc00vbqSK_

It is assigned at the Resource level
TBFG Azure Admin 65 Reputation points

2026-08-17T02:34:50.6733333+00:00

This is still an ongoing issue that has not been resolved. How do I contact Microsoft to be reviewed?

Everything in this thread is not setup as it should be but it is still not connecting.

Pranitha: I sent a reply your private message but I haven't heard back.

Any help would be appreciated.

Answer 1

Alex Burlachenko 25,285 MVP Volunteer Moderator

hi & thx for sharing urs issue here at Q&A portal,

error is usually related to RBAC or Microsoft Entra authorization rather than the Windows Admin Center extension itself. I'd first verify that the account has the required Azure RBAC permissions and the appropriate Virtual Machine Administrator Login (or Virtual Machine User Login) role assigned. If those permissions were granted recently, give Azure 10–15 minutes to finish propagating them before trying again.

If the roles are already in place, I'd check that the Windows Admin Center VM extension is in a Succeeded state, the VM is running, and the Azure VM Agent is healthy. If this only happens with one VM, does the same account work with other VMs? Are u signing in with Microsoft Entra credentials or a local Windows account?

If everything looks correct and you're still getting 'You are not authorized to access this tool', this may require Microsoft to investigate the authorization flow on the backend. If you can share the VM type (Azure VM or Arc-enabled VM), the extension status, and any correlation ID or Activity Log entry from the failed attempt, that will help narrow it down.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

and at my blog https://ctrlaltdel.blog/

TBFG Azure Admin 65 Reputation points

2026-07-14T09:27:20.1666667+00:00

May require Microsoft to investigate the authorization flow on the backend

Now that raises an interesting question!

We pay monthly for Support but as yet, I haven't been able to find how you actually use that subscription. All Support avenues point you to the Learn portal!

Any ideas?

Thanks for the comment though. We have confirmed all of the points you raised. All setup according to universal knowledge... just not working
TBFG Azure Admin 65 Reputation points

2026-07-14T09:29:01.2933333+00:00

May require Microsoft to investigate the authorization flow on the backend

Now that raises an interesting question!

We pay monthly for Support but as yet, I haven't been able to find how you actually use that subscription. All Support avenues point you to the Learn portal!

Any ideas?

Thanks for the comment though. We have confirmed all of the points you raised. All setup according to universal knowledge... just not working

Answer 2

TBFG Azure Admin 65

May require Microsoft to investigate the authorization flow on the backend

Now that raises an interesting question!

We pay monthly for Support but as yet, I haven't been able to find how you actually use that subscription. All Support avenues point you to the Learn portal!

Any ideas?

Thanks for the help though, it is appreciated. We have confirmed all of the points you raised. All setup according to universal knowledge... just not working

Pranitha Sika 0 Reputation points Microsoft External Staff Moderator

2026-07-16T19:55:11.03+00:00

Hi TBFG Azure Admin ,

Thank you for reaching out.

To assist with a deeper investigation, I have requested a few additional details in a private message. Kindly review it and provide the requested information at your earliest convenience.

Thank you!

Answer 3

TBFG Azure Admin 65

Hi Pranitha

I have responded to your private message

Wayne

0 comments

Answer 4

Hi!

Sorry for reviving this thread, but I came across your post while dealing with the exact same error message.

I couldn't find a workaround posted anywhere, so I thought I'd write a reply. If you also use a proxy on your servers, the cause is likely the same.

1. Problem

I also installed via WAC via Azure portal, and faced the same error message, despite RBAC roles being set correctly.
In the browser network trace captured during a failed attempt, the portal request to the session-specific WAC manifest.json endpoint returned HTTP 403 after approximately 60 seconds.

Couldn't start Windows Admin Center.

You are not authorized to access this tool. If you were recently given access, please wait a few minutes and try again. Learn more .

Error:You are not authorized to access this site. Please contact your administrator.

2. Cause

What I found was that the WindowsAdminCenterAccountManagement service does not use the proxy, the proxy only seems to apply WindowsAdminCenter (WAC installed via Azure portal inherits proxy settings from the Arc Agent). At the time of a failed portal connection, the WindowsAdminCenter Event Viewer log recorded an AccountManagement Event ID 704 error:

PrivilegedAccountService: PoP Token validation was failed.

The exception chain included:

IDX20804: Unable to retrieve document from:
https://login.microsoftonline.com/common/.well-known/openid-configuration

The request was canceled due to the configured HttpClient.Timeout
of 30 seconds elapsing.

3a) Workaround

On a test server with no machine-level HTTP_PROXY, HTTPS_PROXY, or NO_PROXY variables, the following REG_MULTI_SZ value was added under the Account Management service key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WindowsAdminCenterAccountManagement

Value name: Environment
Value type: REG_MULTI_SZ

Containing one entry per line:

HTTP_PROXY=http://<proxy-server>:3128
HTTPS_PROXY=http://<proxy-server>:3128
NO_PROXY=localhost,127.0.0.1,169.254.169.254,<internal-domain>,.<internal-domain>

Restart services

Restart-Service WindowsAdminCenterAccountManagement -Force
Restart-Service WindowsAdminCenter -Force

After this service restart, Windows Admin Center could be opened from the Azure portal. (Restarting the WindowsAdminCenter service is likely optional)

This test verified that the Account Management service honored the service-specific Environment value, therefore applying machine-level varibles isn't necessary. I will still list that alternative below

3b) Machine-level alternative

Before the service-scoped test, the following machine-level workaround was verified on affected servers:

[System.Environment]::SetEnvironmentVariable(
    "HTTP_PROXY",
    "http://<proxy-server>:<port>",
    [System.EnvironmentVariableTarget]::Machine
)

[System.Environment]::SetEnvironmentVariable(
    "HTTPS_PROXY",
    "http://<proxy-server>:<port>",
    [System.EnvironmentVariableTarget]::Machine
)

[System.Environment]::SetEnvironmentVariable(
    "NO_PROXY",
    "localhost,127.0.0.1,169.254.169.254,<internal-domain>,.<internal-domain>",
    [System.EnvironmentVariableTarget]::Machine
)

Restart-Service WindowsAdminCenterAccountManagement -Force
Restart-Service WindowsAdminCenter -Force

This also restored portal access, including on an independently tested server after a fresh portal-initiated WAC installation. However, machine-level variables affect any service or application that later starts and honors these standard variables. The service-scoped registry workaround is preferred for limiting the routing change to the service that logged the timeout.

Best regards,

Erik