Hello all, I have an Azure Migrate appliance set up currently and looking to migrate a few servers over to Azure. Everything was registered and got the initial discovery done but I am not able to get the replication going as I am running in to the following error: " The Azure Migrate service cannot access the cache storage account 'xxxxxxxx'. Learn how to configure the storage account for access using managed identities. " I manually created a storage account, attached a private endpoint to it and listed my subnet as the network to connect to. Even went to add additional roles to my account but I am the owner of the subscription. The link that the error provides is very generic and doesn't seem to really offer much of an explanation. Any input would be greatly appreciated.

You need to grant permissions on the storage account (through RBAC) to the managed identity associated with your Azure Migrate project. To accomplish this, you will use the system assigned managed identity of the Azure Recovery Services vault, which Azure Migrate provisioned automatically for you. This Azure Recovery Services vault is actually the resource that orchestrates the replication activities. hth Marcin

try adding Contributor and Storage Blob Data Contributor hth Marcin

Azure migrate project cannot access cache storage account

Accepted answer

Marcin Policht 31,315 Reputation points MVP

2024-02-18T19:25:53.21+00:00

You need to grant permissions on the storage account (through RBAC) to the managed identity associated with your Azure Migrate project. To accomplish this, you will use the system assigned managed identity of the Azure Recovery Services vault, which Azure Migrate provisioned automatically for you. This Azure Recovery Services vault is actually the resource that orchestrates the replication activities.

hth
Marcin
Please sign in to rate this answer.

2 people found this answer helpful.
Jung Choi 27 Reputation points

2024-02-18T19:51:27.73+00:00

Thanks for that information! I did check and I have the recovery vault listed as a "Storage Contributor" on the storage account under IAM. It was added under the "Add Role assignment" option but I am still receiving the error.

Jung Choi 27 Reputation points

2024-02-18T19:57:50.3966667+00:00

Thank you very much for that information. I believe I do already have that set to allow the recovery vault as the storage contributor role for the storage account. When I check the Managed Identities, is shows the recovery vault and the actual project itself to choose from. I added both just to test but still getting the same error.

Jung Choi 27 Reputation points

2024-02-18T20:15:49.0566667+00:00

Ah it looks like the storage contributor wasn't enough of a permission... the only way to get this to work is to add the "Contributor" role with privileged roles... Thanks again for your help!

Neil-6711 1 Reputation point

2024-02-19T17:16:03.81+00:00

hi Jung, which Managed Identity was required, the Migrate Project or the Recovery Services Vault? Thanks!

Jung Choi 27 Reputation points

2024-02-19T17:19:05.7533333+00:00

Hey there, it was the Recovery Services vault that needed it.

Neil-6711 1 Reputation point

2024-02-21T10:56:07.0766667+00:00

Hi again Jung, thanks for your reply. I'm a bit confused, I'm not in a position to test anything but I am researching how a migration from VMware agentless over Express Route and Private Endpoints would look from an architectural point of view.

The documentation appears contradictory and not that clear in terms of what resources are required in your subscription, what gets created in the MS subscription, what talks to what and what data goes where.

The Private Link doc here has a blue box demanding Public Endpoints for those resources which have Private Link. The docs say even if you enable Private Endpoints for the Migrate Project itself, you still need the public endpoint for certain integrations.

Given your experience of being able to test, can you confirm if the blue box here is accurate, please? https://learn.microsoft.com/en-us/azure/migrate/migrate-servers-to-azure-using-private-link?pivots=agentlessvmware#set-up-the-azure-migrate-appliance Cheers, Neil.

Jung Choi 27 Reputation points

2024-02-21T15:24:38.1233333+00:00

I really couldn't tell you why the public endpoint is required per the doc.

If you are using private endpoints for migration, all you should need is the private DNS endpoints and the corresponding DNS entries on your on prem DNS, as far as configuration goes that you have to do.

Jung Choi 27 Reputation points

2024-02-21T15:33:38.1133333+00:00

Reposting as my first comment is not showing up....I am not sure why the public endpoints are needed.As far as the configuration is concerned that you have to do, I didn't need to manage any public endpoints. Did not disable the public endpoints when the project was being created but didn't have to do anything with it.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure migrate project cannot access cache storage account

1 additional answer

Your answer