By David, , updated
An Azure Virtual Desktop (AVD) session host shows Needs Assistance when it fails one of the AVD agent's non-fatal health checks: the URL check (UrlsAccessibleCheck), the Azure Instance Metadata Service check (MetaDataServiceCheck) or the Geneva monitoring agent check (MonitoringAgentCheck). Users can still connect and new sessions are still load balanced to it, but their experience may degrade, so fix it rather than leave it.
The short version: open the host in the portal's Session hosts tab to see which check failed. A failed URL check means a firewall, proxy or hosts file is blocking a required AVD URL. A failed metadata check means
169.254.169.254is blocked or going through a proxy. A failed monitoring check means the Geneva agent is missing, duplicated or its scheduled task isn't running.
What each session host status means
The AVD agent runs health checks on every session host and reports a status (Microsoft Learn). Only Available is healthy:
| Status | Meaning | Gets new sessions? |
|---|---|---|
| Available | Passed all health checks. A host at its session limit still shows Available | Yes |
| Needs Assistance | Failed a non-fatal check: Geneva monitoring agent, metadata service or URL check | Yes |
| Unavailable | Turned off, or failed a fatal check such as domain join or the side-by-side stack listener | No |
| Shutdown | The VM is shut down | No |
| Upgrading | Agent upgrade in progress | Yes |
| Upgrade Failed | The agent couldn't update. Doesn't affect sessions | Yes |
Because a Needs Assistance host still takes new sessions, it's easy to ignore. Don't: a host that can't reach required URLs or the metadata service is the one users will complain about next, and a failed monitoring agent means its connections carry no diagnostic logging.
The health checks behind Needs Assistance
UrlsAccessibleCheck: a required URL is blocked
The host can't reach one or more of the required URLs for Azure Virtual Desktop. Microsoft gives two usual causes (Troubleshoot Azure Virtual Desktop Agent issues):
- A firewall blocking outbound traffic. Add a rule allowing outbound TCP 80 and 443 to the blocked URLs. If you use Azure Firewall, follow Microsoft's guidance for protecting AVD with it, including its DNS settings.
- The local hosts file. Make sure none of the required URLs is in the hosts file. Its location is the
DataBasePathvalue underHKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters.
To find which URL is blocked, run the Required URL Check tool (WVDAgentUrlTool.exe) on the host. It's installed with the agent.
MetaDataServiceCheck: the host can't reach IMDS
The agent couldn't reach the Azure Instance Metadata Service endpoint. Fix:
- Unblock
169.254.169.254in any firewall, network or proxy setting. - Make sure HTTP clients on the VM bypass web proxies for IMDS. For a web proxy, add the bypass with
netsh winhttp set proxy proxy-server="http=<your proxy>" bypass-list="169.254.169.254".
MonitoringAgentCheck: the Geneva agent isn't healthy
The Remote Desktop Services Infrastructure Geneva Agent isn't installed or isn't running. Fix:
- Check it's installed. If several versions are installed, uninstall the older ones and keep the latest.
- If it's missing, read
C:\Program Files\Microsoft RDInfra\GenevaInstall.txtfor the install error. - Check the scheduled task
GenevaTask_<version>exists, is enabled and is running. If not, reinstall the agent from theMicrosoft.RDInfra.Geneva.Installer-x64-<version>.msiinC:\Program Files\Microsoft RDInfra.
At boot: RDAgentBootLoader timeouts
Hosts that show Needs Assistance or Unavailable right after starting, especially with Start VM on Connect, can be hitting a service start timeout for the Remote Desktop Agent Loader (look for Service Control Manager events 7000 or 7011). Microsoft suggests setting the service to Automatic (Delayed Start), raising ServicesPipeTimeout to 60000 ms, and checking that heavy startup tasks aren't starving the agent at boot.
Quick reference
| Failed check | Usual cause | Fix |
|---|---|---|
| UrlsAccessibleCheck | Firewall, proxy or hosts file blocking a required URL | Run WVDAgentUrlTool.exe, unblock the URL |
| MetaDataServiceCheck | 169.254.169.254 blocked or proxied | Unblock it and bypass the proxy for it |
| MonitoringAgentCheck | Geneva agent missing, duplicated or its task stopped | Keep one current version, check GenevaTask |
| Needs Assistance only after boot | Agent loader starting too slowly | Delayed start, longer ServicesPipeTimeout |
If none of that works, Microsoft's last resort is to uninstall the agent, boot loader, Geneva agent and side-by-side stack, remove the host from the pool, generate a new registration key and reinstall. On a pooled host, replacing the host from your image is usually faster. AVD connection errors covers the agent's other error codes.
Needs Assistance hosts still take new sessions. Treat the status as a work item: the failed check tells you exactly which URL, endpoint or agent to fix.
Where Atlas AVD helps
- One filter for every unhealthy host. The Session Hosts list filters to Needs Assistance, and an agent health view shows every host's AVD agent version and health, across pools.
- Replace, don't repair. When a pooled host is broken, Drain & Reclaim or a Re-Image puts a fresh host from your image in its place. DrainGuard deletes drained hosts only once they're empty.
- Run the fix on many hosts. Scripts runs a script, such as the IMDS proxy bypass, through Azure Run Command on up to 50 VMs at a time with each host's output in one view.
- Alerts. Alert rules cover unavailable VMs and are delivered to Teams, Slack or a signed webhook. The Self-Healing Engine, coming soon, will restart hosts the broker reports as unavailable, with caps so a host that keeps failing goes to a person.
That's the real Atlas AVD console in our demo environment; the pools and figures are sample data. AVD fleet management covers running health checks across a whole estate.
FAQ
What does Needs Assistance mean in Azure Virtual Desktop?
The session host failed one of the AVD agent's non-fatal health checks: the URL check, the metadata service check or the monitoring agent check. Users can still connect, but their experience may degrade.
Do users get sent to a host that needs assistance?
Yes. Microsoft says new user sessions are still load balanced to hosts in the Needs Assistance state. Unavailable hosts don't get new sessions.
How do I see which health check failed?
In the Azure portal, open the host pool's Session hosts tab and select the session host. The failed health checks are listed there.
How do I fix UrlsAccessibleCheck?
Run the Required URL Check tool on the host to find the blocked URL, then allow it through your firewall or proxy, and make sure it isn't in the hosts file.
What's the difference between Needs Assistance and Unavailable?
Needs Assistance is a non-fatal failure and the host still takes sessions. Unavailable means the host is off or failed a fatal check, such as domain join or the stack listener, and takes no new sessions.
Can a slow-booting host show Needs Assistance?
Yes. If the Remote Desktop Agent Loader times out at boot, the host can show Needs Assistance or Unavailable. Microsoft suggests a delayed start and a longer service timeout.
Last updated 9 November 2026. Microsoft details are drawn from Microsoft Learn as of November 2026: Session host statuses and health checks, Troubleshoot Azure Virtual Desktop Agent issues and Required FQDNs and endpoints.