Operation is not allowed since VM has an extension in failed state - failed to upgrade managed disks

Question

Operation is not allowed since VM has an extension in failed state - failed to upgrade managed disks

nn 0

The error "Operation is not allowed since VM has an extension in failed state" occurs in Azure Windows 2012 VM. All the extensions are in Provisioning succeeded status, however the error above is blocking operations migrating to managed disks

Manish Deshpande 5,420 Reputation points Microsoft External Staff Moderator

2026-03-31T03:32:28.3166667+00:00
Hello nn

Thank you for reaching out and providing the details of the error you're encountering while attempting to migrate your Azure Windows 2012 VM to managed disks. I understand this is blocking the upgrade, even though the Azure portal shows all extensions in Provisioning succeeded status. This is a common scenario we've seen with migration operations.

The error "Operation is not allowed since VM has an extension in failed state" occurs because Azure's backend validation (error code 409) detects at least one extension in a Failed, Unknown, or inconsistent state. This prevents operations like Convert to AzVM Managed Disk or the portal-based migration, even if the portal UI reports "Provisioning succeeded" for all extensions.

The portal view can sometimes lag or not fully reflect the internal VM model state.

The most effective fix is to identify and remove the problematic extension(s) (safe for non-critical ones like monitoring or diagnostic agents if they're not actively used).

As an alternative or follow-up, manually upgrading the Azure VM Agent often resolves lingering agent/extension mismatches, especially on older OS versions like Windows 2012.

The migration is not reversible, so we recommend a quick backup/snapshot beforehand.

No downtime beyond the normal migration restart is required.

Please follow these steps in order. You'll need the Azure PowerShell module:

1.Verify detailed extension status

$rgName = "<YourResourceGroupName>" $vmName = "<YourVMName>" Get-AzVM -ResourceGroupName $rgName -Name $vmName -Status | Select-Object -ExpandProperty Extensions | Format-Table Name, Type, ProvisioningState, Statuses -AutoSize

Look for any entry where ProvisioningState is not exactly "Succeeded" or where Statuses shows errors/warnings.

2.Remove the problematic extension :

Remove-AzVMExtension -ResourceGroupName $rgName -VMName $vmName -Name "<ExtensionNameFromStep1>" -Force

After removal, run Update-AzVM -ResourceGroupName $rgName -VM $vm to sync.

3.Manually upgrade the VM Agent:

Download the latest Windows VM Agent from the official GitHub release.

Install it inside the VM (run as administrator).

Restart the WindowsAzureGuestAgent service.

This has resolved the exact issue for many customers in similar Q&A threads.

4.Retry the migration:

Deallocate the VM first: Stop-AzVM -ResourceGroupName $rgName -Name $vmName -Force

Convert: ConvertTo-AzVMManagedDisk -ResourceGroupName $rgName -VMName $vmName

Or use the Azure portal Disks blade → Migrate to managed disks button.

Links :
https://learn.microsoft.com/en-us/azure/virtual-machines/windows/convert-unmanaged-to-managed-disks

https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/troubleshoot

These steps should get your VM migrated successfully. If you have any questions or run into issues executing the PowerShell commands, feel free to reply with screenshots and errors.

Thanks,
Manish
Manish Deshpande 5,420 Reputation points Microsoft External Staff Moderator

2026-04-01T16:40:44.17+00:00

Hello nn,

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail and please accept as Yes and upvote if the answer is helpful so that it can help others in the community.

1 answer

Your answer

Manish Deshpande 5,420 Reputation points Microsoft External Staff Moderator

2026-04-01T16:40:44.17+00:00

Hello nn,

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail and please accept as Yes and upvote if the answer is helpful so that it can help others in the community.

Answer 1

nn 0

Hi Manish,

Thank you for your quick response.

I have followed the instructions you provided, and I am attaching the outcome below.

Provision status is not displayed.

Get-AzVM -ResourceGroupName $rgName -Name $vmName -Status | Select-Object -ExpandProperty Extensions | Format-Table Name, Type, ProvisioningState, Statuses -AutoSize

Name Type ProvisioningState Statuses

ApplicationMonitoring Microsoft.Azure.Diagnostics.ApplicationMonitoringWindows {Microsoft.Azure.Management.Compute.Models.InstanceViewStatus}

AzureMonitorWindowsAgent Microsoft.Azure.Monitor.AzureMonitorWindowsAgent {Microsoft.Azure.Management.Compute.Models.InstanceViewStatus}

AzureNetworkWatcherExtension Microsoft.Azure.NetworkWatcher.NetworkWatcherAgentWindows {Microsoft.Azure.Management.Compute.Models.InstanceViewStatus}

AzurePerformanceDiagnostics Microsoft.Azure.Performance.Diagnostics.AzurePerformanceDiagnostics {Microsoft.Azure.Management.Compute.Models.InstanceViewStatus}

MDE.Windows Microsoft.Azure.AzureDefenderForServers.MDE.Windows {Microsoft.Azure.Management.Compute.Models.InstanceViewStatus}

VMSnapshot Microsoft.Azure.RecoveryServices.VMSnapshot {Microsoft.Azure.Management.Compute.Models.InstanceViewStatus}

Manish Deshpande 5,420 Reputation points Microsoft External Staff Moderator

2026-04-06T15:30:15.5633333+00:00
Hello nn,

The extensions you listed (ApplicationMonitoring, AzureMonitorWindowsAgent, AzureNetworkWatcherExtension, AzurePerformanceDiagnostics, MDE.Windows, and VMSnapshot) are all optional agent-based extensions commonly used for monitoring, diagnostics, security, and backup. While the Azure portal (and the basic Get-AzVM output without -Status) shows them in a "Provisioning succeeded" state, the backend control-plane validation for migration operations can still detect an inconsistent or failed internal state. This is exactly why you're seeing the "Operation is not allowed since VM has an extension in failed state" error (error code 409) during the managed disks upgrade.

Key recommendation (supported by official documentation): Before any migration to managed disks, all VM extensions must report a healthy "Provisioning succeeded" state in the VM instance view. If even one extension is in a failed, transitioning, or inconsistent state behind the scenes, Azure blocks the operation for safety. The portal view sometimes lags or doesn't reflect the full backend model.

The most reliable fix in this scenario is to remove the non-critical extensions that are not actively required for core VM functionality. These can safely be re-added after the migration if needed. We’ve seen this resolve the issue for many customers in identical cases.

Run the full status command :

$rgName = "<YourResourceGroupName>" $vmName = "<YourVMName>" Get-AzVM -ResourceGroupName $rgName -Name $vmName -Status | Select-Object -ExpandProperty Extensions | Format-Table Name, Type, ProvisioningState, Statuses -AutoSize

Please reply with the output so we can pinpoint the exact extension if needed. Look for anything other than "Succeeded" in ProvisioningState or error messages in the Statuses column.

Remove the problematic/non-critical extensions :

$rgName = "<YourResourceGroupName>" $vmName = "<YourVMName>" # Remove one at a time (safe to remove these): Remove-AzVMExtension -ResourceGroupName $rgName -VMName $vmName -Name "ApplicationMonitoring" -Force Remove-AzVMExtension -ResourceGroupName $rgName -VMName $vmName -Name "AzureMonitorWindowsAgent" -Force Remove-AzVMExtension -ResourceGroupName $rgName -VMName $vmName -Name "AzureNetworkWatcherExtension" -Force Remove-AzVMExtension -ResourceGroupName $rgName -VMName $vmName -Name "AzurePerformanceDiagnostics" -Force Remove-AzVMExtension -ResourceGroupName $rgName -VMName $vmName -Name "MDE.Windows" -Force # Defender - can be re-enabled later Remove-AzVMExtension -ResourceGroupName $rgName -VMName $vmName -Name "VMSnapshot" -Force # Backup snapshot agent

After each removal (or after all), run:

Update-AzVM -ResourceGroupName $rgName -VM (Get-AzVM -ResourceGroupName $rgName -Name $vmName)

Manually upgrade the VM Guest Agent inside the VM:

Download the latest Windows VM Agent MSI from the official GitHub releases.

Install it as Administrator inside the VM.

Restart the WindowsAzureGuestAgent service (or reboot the VM). This often clears lingering agent/extension mismatches on legacy OS versions.

Retry the migration:

Deallocate the VM first: Stop-AzVM -ResourceGroupName $rgName -Name $vmName -Force

Then convert: ConvertTo-AzVMManagedDisk -ResourceGroupName $rgName -VMName $vmName

Or use the Azure portal: VM → Disks → "Migrate to managed disks".

Links

https://learn.microsoft.com/en-us/azure/virtual-machines/windows/convert-unmanaged-to-managed-disks
https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/troubleshoot

Thanks,
Manish.
Manish Deshpande 5,420 Reputation points Microsoft External Staff Moderator

2026-04-08T09:57:27.3+00:00

Hello nn,

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail and please accept as Yes and upvote if the answer is helpful so that it can help others in the community.
Manish Deshpande 5,420 Reputation points Microsoft External Staff Moderator

2026-04-10T16:23:02.03+00:00

Hello nn,

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail and please accept as Yes and upvote if the answer is helpful so that it can help others in the community.

Share via

Operation is not allowed since VM has an extension in failed state - failed to upgrade managed disks

1 answer

Your answer