A deployment uses supported Entra-joined session hosts. Users see a resource but cannot sign in to the VM. What must be checked beyond application publication?

1. Only the storage account access tier
2. The supported authentication setup, user eligibility, and required VM sign-in permissions
3. Give users tenant-wide Global Administrator as the default fix
4. Only the workspace's friendly name