Azure migrate project cannot access cache storage account

Question

Azure migrate project cannot access cache storage account

Jung Choi 32

Hello all, I have an Azure Migrate appliance set up currently and looking to migrate a few servers over to Azure. Everything was registered and got the initial discovery done but I am not able to get the replication going as I am running in to the following error:

" The Azure Migrate service cannot access the cache storage account 'xxxxxxxx'. Learn how to configure the storage account for access using managed identities. " I manually created a storage account, attached a private endpoint to it and listed my subnet as the network to connect to. Even went to add additional roles to my account but I am the owner of the subscription. The link that the error provides is very generic and doesn't seem to really offer much of an explanation.

Any input would be greatly appreciated.

Ramasubramanian, Balachandran 0 Reputation points

2025-01-11T08:14:30.92+00:00

Even though Marcin Policht is correct,the challenge is its difficult to follow the steps exactly and get the Issue resolved without clear screenshots.Since we had this Issue and then we resolved it, thought of detailing it so it can be helpful to others.

Please follow below steps to resolve the Issue

1.Open Azure site recovery respective to the AZ migrate which we created as part of the Migration.

2.System Identity should be enabled for the ASR

Take the ASR object ID for reference and open the storage account which is created for the replication and provide Storage Blob data contributor role (under Job function roles) for this ASR (targetvault) in this case.
Manjunatha Munireddy 1 Reputation point

2025-03-05T15:21:12.1866667+00:00

I have the same exact issue, I have also assigned the RBAC roles Contributor and Storage Blob Data Contributor on Storage Account for the Recovery Service Vault (RSV) managed identity and Azure Migrate Project managed identity, but still it shows same error.

Accepted answer

2 additional answers

Your answer

Ramasubramanian, Balachandran 0 Reputation points

2025-01-11T08:14:30.92+00:00

Even though Marcin Policht is correct,the challenge is its difficult to follow the steps exactly and get the Issue resolved without clear screenshots.Since we had this Issue and then we resolved it, thought of detailing it so it can be helpful to others.

Please follow below steps to resolve the Issue

1.Open Azure site recovery respective to the AZ migrate which we created as part of the Migration.

2.System Identity should be enabled for the ASR

Take the ASR object ID for reference and open the storage account which is created for the replication and provide Storage Blob data contributor role (under Job function roles) for this ASR (targetvault) in this case.
Manjunatha Munireddy 1 Reputation point

2025-03-05T15:21:12.1866667+00:00

I have the same exact issue, I have also assigned the RBAC roles Contributor and Storage Blob Data Contributor on Storage Account for the Recovery Service Vault (RSV) managed identity and Azure Migrate Project managed identity, but still it shows same error.

Answer 1

Marcin Policht 38,470 MVP

You need to grant permissions on the storage account (through RBAC) to the managed identity associated with your Azure Migrate project. To accomplish this, you will use the system assigned managed identity of the Azure Recovery Services vault, which Azure Migrate provisioned automatically for you. This Azure Recovery Services vault is actually the resource that orchestrates the replication activities.

hth
Marcin

Jung Choi 32 Reputation points

2024-02-18T19:51:27.73+00:00

Thanks for that information! I did check and I have the recovery vault listed as a "Storage Contributor" on the storage account under IAM. It was added under the "Add Role assignment" option but I am still receiving the error.
Jung Choi 32 Reputation points

2024-02-18T19:57:50.3966667+00:00

Thank you very much for that information. I believe I do already have that set to allow the recovery vault as the storage contributor role for the storage account. When I check the Managed Identities, is shows the recovery vault and the actual project itself to choose from. I added both just to test but still getting the same error.
Jung Choi 32 Reputation points

2024-02-18T20:15:49.0566667+00:00

Ah it looks like the storage contributor wasn't enough of a permission... the only way to get this to work is to add the "Contributor" role with privileged roles... Thanks again for your help!
Neil-6711 1 Reputation point

2024-02-19T17:16:03.81+00:00

hi Jung, which Managed Identity was required, the Migrate Project or the Recovery Services Vault? Thanks!
Jung Choi 32 Reputation points

2024-02-19T17:19:05.7533333+00:00

Hey there, it was the Recovery Services vault that needed it.
Neil-6711 1 Reputation point

2024-02-21T10:56:07.0766667+00:00

Hi again Jung, thanks for your reply. I'm a bit confused, I'm not in a position to test anything but I am researching how a migration from VMware agentless over Express Route and Private Endpoints would look from an architectural point of view.

The documentation appears contradictory and not that clear in terms of what resources are required in your subscription, what gets created in the MS subscription, what talks to what and what data goes where.

The Private Link doc here has a blue box demanding Public Endpoints for those resources which have Private Link. The docs say even if you enable Private Endpoints for the Migrate Project itself, you still need the public endpoint for certain integrations.

Given your experience of being able to test, can you confirm if the blue box here is accurate, please? https://learn.microsoft.com/en-us/azure/migrate/migrate-servers-to-azure-using-private-link?pivots=agentlessvmware#set-up-the-azure-migrate-appliance Cheers, Neil.
Jung Choi 32 Reputation points

2024-02-21T15:24:38.1233333+00:00

I really couldn't tell you why the public endpoint is required per the doc.

If you are using private endpoints for migration, all you should need is the private DNS endpoints and the corresponding DNS entries on your on prem DNS, as far as configuration goes that you have to do.
Jung Choi 32 Reputation points

2024-02-21T15:33:38.1133333+00:00

Reposting as my first comment is not showing up....I am not sure why the public endpoints are needed.As far as the configuration is concerned that you have to do, I didn't need to manage any public endpoints. Did not disable the public endpoints when the project was being created but didn't have to do anything with it.
Caio Bauab 1 Reputation point

2025-03-13T01:11:11.1433333+00:00

@Jung Choi is correct. We need to add 'Contributor' role too. Works here for me.

Thanks @Jung Choi !

Answer 2

Marcin Policht 38,470 MVP

try adding Contributor and Storage Blob Data Contributor

hth
Marcin

Answer 3

I have the same exact issue, I have also assigned the RBAC roles Contributor and Storage Blob Data Contributor on Storage Account for the Recovery Service Vault (RSV) managed identity and Azure Migrate Project managed identity, but still it shows same error.

Also i have allowed "Allow Azure services on the trusted services list to access this storage account" on Storage Account.

Still it is NOT working.

ERROR:

The Azure Migrate service cannot access the cache storage account 'migcache01'. Learn how to configure the storage account for access using managed identities.

Share via

Azure migrate project cannot access cache storage account

2 additional answers

Your answer