Tenant Transfer Data Encryption Set Error

Naugle, Jordyn 0

Our Azure disk encryption set provisioning state is stuck in failed after transfer of tenant. We can not set the identity and all VM's are not operating. Any ideas?

Vinodh247 13,226 Reputation points

2024-07-19T13:32:05.39+00:00

are you using keyvault? these issues are mostly caused by managed identities and permissions related to the keyvault
Naugle, Jordyn 0 Reputation points

2024-07-19T13:44:54.6866667+00:00

@Vinodh247 Yes, we have a keyvault in the new tenant that is connected to the DES, but can not connect an identity or switch the DES on the disk. Errors below.

Changing the key vault or adding an identity in the DES:
An unexpected error occurred while updating the disk encryption set. Please retry later. (first error)
(every error after) Previous identity update is in failed state. Please retry the operation to update the disk encryption set to use identity

Switch the DES on the disk: Error while creating storage object
Vinodh247 13,226 Reputation points

2024-07-19T13:58:15.0633333+00:00
I would suggest you check the following and let me know...

Check the Access Policies to ensure that the managed identity associated with the des has the necessary permissions. Specifically, it should have permissions to Get, Wrap, and Unwrap keys. If these permissions are missing, add them and save the changes

Check for Firewall Restrictions: If the vm is restricted by network security groups or firewall settings, it may not be able to communicate with the Key Vault, leading to errors when trying to update the des

If the provisioning state is still in a failed state, consider deleting the existing des and creating a new one. If the disks are in use, deallocate the VMs before making changes to the des settings.

Verify that the managed identity is properly configured and has the necessary permissions to access the keyvault. You may need to reassign or recreate the managed identity

Share via

Tenant Transfer Data Encryption Set Error