2 of 4 AVD suddenly show "need assistance" UrlsAccessibleCheck

Hello ONTADM

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

In the Azure portal, please navigate to the session hosts. Select the affected ones under the "Session hosts" tab to confirm that the "UrlsAccessibleCheck" is the failing health check.

For troubleshooting issues related to session connectivity and the Azure Virtual Desktop agent, we recommend you review the event logs on your session host virtual machines (VMs) by going to Event Viewer > Windows Logs > Application. Look for events that have one of the following sources to identify your issue: ( https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-desktop/troubleshoot-agent)

1. WVD-Agent
2. WVD-Agent-Updater
3. RDAgentBootLoader
4. MsiInstaller

The Azure Virtual Desktop Agent regularly runs health checks on the session host. The agent assigns these health checks various statuses that include descriptions of how to fix common issues - https://docs.azure.cn/en-us/virtual-desktop/session-host-status-health-checks

Also ensure that outbound connections to required Azure Virtual Desktop service URLs and ports (especially TCP 80/443) are not restricted by NSG, Azure Firewall, local firewalls, security appliances, or proxies

For your reference, please refer to the following documentation:

• Azure Virtual Desktop Required FQDN Endpoint
• Azure Virtual Desktop Session Host Status Health Checks

Also try checking the URLs are not being blocked:

For example, rdbroker.wvd.microsoft.com, rddiagnostics.wvd.microsoft.com, and region-specific endpoints

Kindly let us know if the suggested steps helps or you need further assistance on this issue.

Regards

Himanshu

Hello ONTADM, I am Henry and I want to share my insight about your issue.

This situation indicates that the issue is not a general network block (like a firewall or NSG rule) but is related to the specific security context in which the AVD agent service runs, or the agent software itself is in a corrupted state. The AVD agent runs as the NT AUTHORITY\SYSTEM account. When you RDP into the VM and run the tool, you are running it as your logged-in user account.

Here are some steps you can refer:

Step 1: Reinstall the AVD Agent Stack

1. Log in as an administrator to one of the failing VMs.
2. Go to Apps & features and uninstall these two applications in order:

• Remote Desktop Agent Boot Loader
• Remote Desktop Services SxS Network Stack

3. Go to C:\Program Files\Microsoft RDInfra and ensure the agent directories are removed.
4. Reboot the virtual machine.
5. Download the latest AVD agent and bootloader from the official Microsoft links.
6. Install the AVD agent (Microsoft.RDInfra.RDAgent.Installer...) first.
7. Install the AVD agent bootloader (Microsoft.RDInfra.RDAgentBootLoader.Installer...) second.
8. After a few minutes, check the Azure portal. The status should update to "Available."

Step 2: If reinstalling the agent doesn't work, we must confirm the SYSTEM account is being blocked.

1. Download PsExec from the official Microsoft Sysinternals suite.
2. Open an administrative Command Prompt on a failing VM and run the following command to open a new command prompt running as the SYSTEM account: psexec -s -i cmd.exe
3. In the new command prompt window (which is running as SYSTEM), try to access one of the critical AVD URLs using PowerShell: Invoke-WebRequest -Uri 'https://rdbroker.wvd.microsoft.com' -UseBasicParsing

If this command fails or times out, it confirms that a proxy, local firewall, or security policy is blocking network access for the local SYSTEM account. You will need to work with your network team to adjust the policy to allow this traffic.

Online Documentation

• Required URL List for AVD

I hope this information and these keywords help point you in the right direction for your research. Let me know how it goes, and if this answer helps, feel free to hit “Accept Answer” so others can benefit too