When trying to add an on premise virtual machine within our Azure Update Manager Environment I go through the setup wizard and select our information. I have been able to previously add machines without issue however I have tried across multiple OSs (2019, 2022, and 2025) and now within the Resource Group Activity Log i see the following failed status. Write Azure Arc machines Time stampFri Nov 15 2024 16:43:14 GMT-0600 (Central Standard Time) Event initiated byHybrid RP Application Error codeResourceReadForbidden MessageThe resource '/subscriptions/our tenant infomation/resourceGroups/IT-OPS-SERVERS/providers/Microsoft.HybridCompute/machines/WAU-OPSINF-002' could not be evaluated by Azure Policy because the requester does not have permissions to GET the resource. As the account I am using is an owner from the subscription level I should have full permissions to everything down to the Resource group, however if I am reading this correctly Hybrid RP Application is trying to run this Operation? Im not sure where to adjust this roles permission to allow the Get.

Error Adding On Prem VM into Azure Update Manager through Azure Arc

Brandon White 0

When trying to add an on premise virtual machine within our Azure Update Manager Environment I go through the setup wizard and select our information. I have been able to previously add machines without issue however I have tried across multiple OSs (2019, 2022, and 2025) and now within the Resource Group Activity Log i see the following failed status.

Write Azure Arc machines
Time stampFri Nov 15 2024 16:43:14 GMT-0600 (Central Standard Time)
Event initiated byHybrid RP Application
Error codeResourceReadForbidden
MessageThe resource '/subscriptions/our tenant infomation/resourceGroups/IT-OPS-SERVERS/providers/Microsoft.HybridCompute/machines/WAU-OPSINF-002' could not be evaluated by Azure Policy because the requester does not have permissions to GET the resource.

As the account I am using is an owner from the subscription level I should have full permissions to everything down to the Resource group, however if I am reading this correctly Hybrid RP Application is trying to run this Operation? Im not sure where to adjust this roles permission to allow the Get.

Rahul Podila 805 Reputation points Microsoft Vendor

2024-11-18T09:33:12.27+00:00

Hi @Brandon White
Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

You seem to be seeing a "ResourceReadForbidden" error when trying to add your on-premise virtual machine to Azure Update Manager using Azure Arc. This problem is usually caused by an Azure Hybrid RP Application (the service that runs Azure Arc) that does not have the proper permissions to access your VM.

Although your account has Owner permissions at the subscription level, the Hybrid RP Application requires specific roles to interact with its resources. To prevent this, you need to log in to the Azure Portal, find your resource group or subscription, and ensure that the Contributor role is assigned to the Hybrid RP Application. This allows you to manage objects in that group.

Additionally, check if there are any Azure settings that can prevent Hybrid RP applications from accessing your VM. If there are, you may need to update the settings or uninstall your VM.

Also, make sure that your Azure Arc-enabled VM has Managed Identity enabled, and that the Contributor role is assigned to Managed Identity. This ensures that the VM is able to properly communicate with the Azure service.

Once you have done this, try adding the VM to Azure Update Manager again. The bug needs to be fixed, and everything should work as expected.
If you have any further queries, do let us know

If the answer is helpful, please click "Accept Answer" and "Upvote it"
Rahul Podila 805 Reputation points Microsoft Vendor

2024-11-19T01:03:03.02+00:00

Hi @Brandon White
If you had a chance to see my comment to your question. If it was helpful, please click "Upvote" on my post let us know Thank you...!
Brandon White 0 Reputation points

2024-11-19T18:49:12.42+00:00

I have, however when I check the resource group that the Arc-Enabled vm is to be added to im not seeing where Hybrid RP application is to make any changes or to see what is already set.
Brandon White 0 Reputation points

2024-11-19T19:01:51.9233333+00:00

@Rahul Podila I saw the note however when I check the Resource Group I cannot seem to find where to set any settings/roles for the Hybrid RP application. Is there some additional steps I am missing?
Rahul Podila 805 Reputation points Microsoft Vendor

2024-11-21T09:39:33.5866667+00:00
Hi @Brandon White
I apologize for any confusion. To assign the Contributor role to the Hybrid RP Application, you can follow these steps:

Go to the Azure Portal and navigate to the resource group or subscription where your VM is located.

Click on the "Access control (IAM)" tab.

Click on the "+ Add" button and select "Add role assignment".

In the "Add role assignment" pane, select "Contributor" as the role and search for the Hybrid RP Application by name or ID.

Click on "Save" to assign the Contributor role to the Hybrid RP Application.

If you are still unable to find the Hybrid RP Application, you can try searching for it in the Azure Portal by name or ID. If you are still having trouble, I recommend reaching out to Azure Support for further assistance.
Brandon White 0 Reputation points

2024-11-21T14:52:08.1033333+00:00

So, it looks like that resolved the error however what initally got me to that point was that the Azure Arc enabled machines were not showing up within the Azure Update Manager which is still holding true. When in the overview of Azure Updated Manager I can see the number of Arc Enabled machines, but within Resources and I click Machines the Arc enabled vm is not listed only the Azure Virtual Machines.
Brandon White 0 Reputation points

2024-11-21T14:55:26.0766667+00:00

So this looks to have resolved the error that was posted as it does not seem to be generating this now, however what led me to this error initially is that my Arc Enabled Servers were not displaying within Azure Update Manager. I can see the count of Arc Enabled Servers within the overview but when I click to Resources>Machines the Arc Enabled virtual server is not listed.
Rahul Podila 805 Reputation points Microsoft Vendor

2024-11-22T01:39:23.01+00:00
Hi @Brandon White
Regarding the issue with the Azure Arc-enabled machines not showing up in Azure Update Manager, it's possible that there is a delay in the data replication between Azure Arc and Azure Update Manager.

To troubleshoot this issue, you can try the following steps:

Wait for some time to see if the Azure Arc-enabled machines show up in Azure Update Manager. It may take some time for the data to be replicated.

Check if the Azure Arc-enabled machines are properly registered with Azure Arc. You can do this by checking the Azure Arc-enabled servers blade in the Azure Portal.

Check if the Azure Arc-enabled machines are properly configured for Azure Update Manager. You can do this by checking the Azure Update Management solution in the Azure Portal.

Check if there are any issues with the Azure Update Management agent on the Azure Arc-enabled machines. You can do this by checking the agent logs on the machines.

If you are still unable to see the Azure Arc-enabled machines in Azure Update Manager after trying these steps, I recommend reaching out to Azure Support for further assistance.
If you have any further queries, do let us know

If the answer is helpful, please click "Accept Answer" and "Upvote it"

Share via

Error Adding On Prem VM into Azure Update Manager through Azure Arc

Your answer