Azure Performance Diagnostics Extension deployment failed

I got the following error when deploying AzPerfDiagExtension via Azure Portal

"VMExtensionProvisioningError", "message": "VM has reported a failure when processing extension 'AzurePerformanceDiagnostics' (publisher 'Microsoft.Azure.Performance.Diagnostics' and type 'AzurePerformanceDiagnostics'). Error message: 'Failed to enable extension 'AzPerfDiagExtension' because either the storage account name or key provided is invalid. Please re-install extension 'AzPerfDiagExtension' using a valid storage account name and key or install Performance Diagnostics by navigating to the VM -> Help -> Performance Diagnostics blade.'. More information on troubleshooting is available at https://aka.ms/vmextensionwindowstroubleshoot. "

There are two blades how to initiate PerfDiag installation. One is to add an extension to the VM, and the second is to scroll down to the independent tab "Performance Diagnostics" in the Help column of the virtual machine.

It offers to use storage keys and managed identity. I could list SAK so I expected at least this option working but it wasn't. My role was "only" contributor so I was expecting an error coming from some permission issue.

Here are the permissions needed listed to Run Performance Diagnostics.

• The Owner role on the VM and an Azure role that includes the Microsoft.Storage/storageAccounts/listkeys/action permission on the storage account

I requested owner role for VM and I got it. The issue is that I am owner for my user account, but that isn't affecting relation between the VM and the storage account. What I did to fix the problem is to assign permissions of owner" (actually somehting less should be better) for the managed identity of the VM via IAM configuration.

Once again I granted permissions via IAM to storage account for the managed identity of the VM, not for myself as user. It wasn't obvious to me that it is needed like this and I spent some time trying to figure out what it was.

What is interesting on this solution is that I previously tried to configure performance diagnostic with manual storage account name and SAK insertion to the Azure portal installation wizard (for VM Extension installation) but it failed as many time before.

What was tried (before granting permission for SA to managed identity of the VM)

1. Copied fresh keys from the Storage account “Access keys” blade and manually pasted into the extension protected settings (not using connection strings).
2. Explicitly set authenticationType: StorageKey.
3. Confirmed account name syntax (lowercase, alphanumeric).
4. Verified region match (VM and storage in same Azure region).
5. Ensured network access (public “All networks”).
6. Retried installation through both Support + troubleshooting → Performance diagnostics blade and extension install path.

The error might have more verbose version from Performance diagnostic blade

Failed to retrieve storage account information for performance diagnostics. Try reinstalling performance diagnostics. Error details: {"name":"StorageError","message":"Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.\n
"xhr":{"status":403,"statusText":"Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.","responseText":"{\"odata.error\":{\"code\":\"AuthenticationFailed\",\"message\":{\"lang\":\"en-US\",\"value\":\"Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.\"}}}"}}} {"name":"StorageError","message":"The table specified does not exist\n
"status":404,"statusText":"Not Found","responseText":"{\"odata.error\":{\"code\":\"TableNotFound\",\"message\":{\"lang\":\"en-US\",\"value\":\"The table specified does not exist.\"}}}"}}}

Global admin don't see subscription with GDAP

I am an indirect reseller (Tier 2) and I recently ordered an Azure subscription from our Indirect provider for our existing customer's tenant with approved GDAP roles but when I entered service management via Partner Center and open Azure Portal I didn't see any subscription available. 

The subscription was deployed and I saw it when I was using the Global Admin account in the customer's tenant (domain .onmicrosoft.com). At the same time, I was unable to see the same subscription with the GDAP technician account. This was a decent blocker.

I was expecting I could solve it myself because what else than double Global admin would be needed? It ended up with the indirect provider being the side to fix it by making the subscription accessible. The keyword for the whole operation is "include the indirect reseller".

Partner with indirect resellers in the Cloud Solution Provider program - Partner Center | Microsoft Learn

Well, I thought at first it would be enough. But no, still no change. The next keyword to follow is "AOBO" which stands for 'Admin on Behalf of' and it is briefly explained in the article:

Workloads supported by granular delegated admin privileges (GDAP) - Partner Center | Microsoft Learn

But what I found explaining even better was this CSP dev video (from 17:45 onwards).

Subscription owner role needs to be set via Powershell (only) for a groupID that exists with AdminAgents GDAP role in Tier2's PartnerCenter by a user with global admin or similar elevated permissions based on the customer's tenant.

The commands are following

1. Install-Module -Name AzureAD
2. Connect-AzureRmAccount
3.  Get-AzureRmSubscription
4. New-AzureRmRoleAssignment

So good old Powershell only magic in Azure. After configuring that the subscription is normally visible to all Partner tenant users so I could get back to the actual assignment.

Note: if you don't see subscription even with the customer tenant account then you might want to use this elevation trick in Entra:

Remote Desktop client login loop

I was experiencing issue with Remote Desktop app (with orange icon) for accessing AVD workspace. It was working in browser version, it was working on my iPad but I was unable to login from my private Windows PC.

I got into the workspace resources with my username and password in email format but RDP was not initiating and looping in login prompt:

the username and password used to connect to the remote resource didn't work

What I found was the source of problem: I had installed RDS client from Microsoft Store "Windows Store Remote Desktop app" but version from there is not working with AVD and Windows Server 2019. I had to get MSI installer and proceed with that. After that all worked smoothly.

Web client: https://client.wvd.microsoft.com/arm/webclient/

Windows client download: https://learn.microsoft.com/en-us/azure/virtual-desktop/users/connect-windows (get MSI package)  

Other platforms link: https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-clients

Universal workspace URL: https://rdweb.wvd.microsoft.com/api/arm/feeddiscovery

That's all, I hope it helped :)

Microsoft Dynamics Office Add-in error AADSTS650057

Business Central Excel add-in alias Microsoft Dynamics Office Add-in allows users to read, analyze, and edit data from Microsoft Dynamics systems and publish data changes back to Microsoft Dynamics OData services. 

I had two instances where one was reporting an error AADSTS650057:

Invalid resource. The client has requested access to a resource
which is not listed in the requested permissions in the client's
application registration.

Client app ID: {appId}({appName}).

Resource value from request: {resource}.

Resource app ID: {resourceAppId}.

List of valid resources from app registration: {regList}.

Official documentation: 

• plugin download / plugin download
• official config guide
  
• update guide
  

How to debug it? First to find all mentioned App registrations and Enterprise apps in Microsoft Entra and find the configuration especially IDs. Note that AppId is matching with App Id URI.

Open Business Central console and compare what values are set there. Two different app IDs are set

 

What is in the values?

Endpoint URI: https://login.microsoftonline.com/<tenantID>/wsfed?wa=wsignin1.0%26wtrealm=api://<appRegNonExcel>%26wreply=https://<BCurl>/SignIn

Metadata location: https://login.microsoftonline.com/<tenantID>/federationmetadata/2007-06/federationmetadata.xml

So if here is all correct but you have still problem let's check permissions on the App registrations side.

The main BC app reg needs to have exposed API with API.ReadWrite.All permission

v

 

And when this is done, it is possible to add  permissions to "excel App registrations"

Delegated admin permissions must be granted and consented from the previously mentioned app registration to this one. If you cannot see the previous app in the list, you didn't publish it properly.

 

After settings all this correctly the login from Excel add-in proceeded to login screen without error page.

I hope this helped.