VM DR Cache Storage with Entra ID

Question

Problem Statement: We previously had a Windows Server VM with Disaster Recovery (DR) configured, where the Cache Storage Account utilized Shared Access Keys for authentication. Following a recommendation from MDFC, we transitioned the storage account to use Entra ID-based authentication instead. However, after disabling Shared Access Keys, the DR process encountered errors, as the VM was no longer able to establish a connection with the Cache Storage Account.

Answer 1

Hi @Kristaps Karniitis , I understand you have an Azure VM (Windows Server) with DR configured. DR is using ASR (Azure Site Recovery) and it requires a Cache Storage Account. You have a requirement to disable Storage Account Keys, but if you disable it, DR process has errors.

Cache storage requirements state that managed identity is not supported. The cached storage account must allow shared key access and Shared Access Signatures (SAS) signed by the shared key. Recent changes in Azure Policy disable key authentication due to security concerns. However, for ASR, you need to enable it again.

You need to configure an exception in MDFC (Microsoft Defender for Cloud) that all cache storage accounts for ASR need to allow access to storage account keys. That's a requirement for ASR to work.

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.