How to fix AVD issue where session host keep showing Needs Assistance in Health State

Question

How to fix AVD issue where session host keep showing Needs Assistance in Health State

Mohit 0

I am getting issue with AVD session host and users are unable to connect when VM health state says Needs Assistance.

AADJoinedHealthCheck:- Failed.

"healthCheckName": "AADJoinedHealthCheck",

	"healthCheckResult": "HealthCheckFailed",

	"additionalFailureDetails": {

		**"message": "SessionHost NeedsAssistance: SessionHost enountered error 0xC0090030.",**

		"errorCode": -1073151952,

0 comments

1 answer

Your answer

Answer 1

Hi Mohit,

Welcome to Microsoft Q&A,

Error 0xC0090030 is a TPM/crypto-provider error ("device required by this cryptographic provider not ready"), the AADJoinedHealthCheck failure means the session host's TPM-backed Entra device key can't be validated. This is a known pattern, most often caused by a duplicate or corrupted device identity, commonly from a golden image that was captured while already Entra joined.

Confirm the state on the affected host. RDP or console in as admin and run:

   dsregcmd /status

Check AzureAdJoined, DeviceId, and look for TPM-related errors in the output.

Check for duplicates in Entra. In the Entra admin center, go to Identity > Devices > All devices, search the session host's computer name. If multiple device objects share the same name (common when several VMs came from one golden image), delete the stale/duplicate entries, keep the most recently active one.
Reset the device registration. On the affected VM, as admin:

   dsregcmd /leave

Reboot the host. On restart, it should silently re-register with Entra and generate a fresh TPM-backed key.

Confirm the fix. Back in Azure Virtual Desktop > Host pools > Session hosts, watch the host status. AADJoinedHealthCheck should flip to Healthy within a few minutes of boot.
If this hits multiple/most hosts from the same image: the golden image itself was likely captured while Entra joined. Rebuild the image, running dsregcmd /leave and clearing the WorkplaceJoin state before sysprep/capture, so new VMs don't inherit a shared device identity.

Reference: Microsoft Entra joined session hosts in Azure Virtual Desktop, Create an Azure Virtual Desktop golden image

Please click Accept Answer and upvote if this helped.