Azure VPN Gateway - resource is stuck in a Microsoft-managed migration state and cannot be modified.

Question

Azure VPN Gateway - resource is stuck in a Microsoft-managed migration state and cannot be modified.

Jonah Wermter 0

Production Azure VPN Gateway is operational and passing existing VPN traffic, however all configuration changes fail. Gateway SKU: VpnGw2AZ

Observed behavior: - NAT rule creation fails - Tag updates fail - Any write operation against the gateway fails

Error returned: CannotMakeChangesToGatewayDuringMigration

Gateway details: provisioningState = Succeeded virtualNetworkGatewayMigrationStatus: state = InProgress phase = ExecuteSucceeded errorMessage = ""

This appears to be an Azure-side migration state that never completed. Impact: Unable to modify VPN Gateway configuration to implement a new site-to-site VPN connection required for an application integration project. Please review and clear the migration state or provide remediation steps.

Rachana Thipparapu 10 Reputation points Microsoft External Staff Moderator

2026-08-04T10:05:06.1533333+00:00
Hello Jonah,

Hope you are doing well.

Thank you for providing the detailed information regarding the VPN Gateway issue.

Based on our review, the VPN Gateway is currently operational and continues to pass existing VPN traffic successfully. However, the gateway appears to be in a migration state that has not been fully finalized, which is preventing any configuration changes from being made. The reported error,"CannotMakeChangesToGatewayDuringMigration," along with the migration status showing InProgress while the provisioning state shows Succeeded, indicates that the gateway is currently locked by an incomplete migration operation.

As a result, all write operations against the gateway are being blocked, including:

Creating or modifying NAT rules

Adding new Site-to-Site VPN connections

Updating resource tags

Modifying gateway configuration settings

At this point, the issue appears to be related to the gateway's migration state rather than any customer-side configuration.

To assist with the investigation, could you please provide the following information:

The approximate date and time when the migration or upgrade activity was initiated.

Whether any recent VPN Gateway migration, Public IP migration (Basic to Standard), or SKU upgrade was performed before the issue started.

A screenshot of the migration status from the Azure portal, if available.

Any relevant Activity Log entries showing failed or ongoing operations related to the VPN Gateway.

Once we receive the requested information, we will continue our investigation and provide further update

Thank you for your patience and cooperation.

Regards,

Rachana
Rachana Thipparapu 10 Reputation points Microsoft External Staff Moderator

2026-08-05T17:05:25.4+00:00

Hello @Jonah Wermter

I wanted to follow up on our previous conversation and check if you had an opportunity to review the information shared. If you have any questions or concerns please feel free to let me know.
Rachana Thipparapu 10 Reputation points Microsoft External Staff Moderator

2026-08-06T16:09:54.0866667+00:00

Hello @Jonah Wermter

Just follow up on our previous conversation and check if you had an opportunity to review the information shared. If you have any questions or concerns please feel free to let me know.

1 answer

Your answer

Rachana Thipparapu 10 Reputation points Microsoft External Staff Moderator

2026-08-04T10:05:06.1533333+00:00

Hello Jonah,

Hope you are doing well.

Thank you for providing the detailed information regarding the VPN Gateway issue.

Based on our review, the VPN Gateway is currently operational and continues to pass existing VPN traffic successfully. However, the gateway appears to be in a migration state that has not been fully finalized, which is preventing any configuration changes from being made. The reported error,"CannotMakeChangesToGatewayDuringMigration," along with the migration status showing InProgress while the provisioning state shows Succeeded, indicates that the gateway is currently locked by an incomplete migration operation.

As a result, all write operations against the gateway are being blocked, including:

Creating or modifying NAT rules

Adding new Site-to-Site VPN connections

Updating resource tags

Modifying gateway configuration settings

At this point, the issue appears to be related to the gateway's migration state rather than any customer-side configuration.

To assist with the investigation, could you please provide the following information:

The approximate date and time when the migration or upgrade activity was initiated.

Whether any recent VPN Gateway migration, Public IP migration (Basic to Standard), or SKU upgrade was performed before the issue started.

A screenshot of the migration status from the Azure portal, if available.

Any relevant Activity Log entries showing failed or ongoing operations related to the VPN Gateway.

Once we receive the requested information, we will continue our investigation and provide further update

Thank you for your patience and cooperation.

Regards,

Rachana
Rachana Thipparapu 10 Reputation points Microsoft External Staff Moderator

2026-08-05T17:05:25.4+00:00

Hello @Jonah Wermter

I wanted to follow up on our previous conversation and check if you had an opportunity to review the information shared. If you have any questions or concerns please feel free to let me know.
Rachana Thipparapu 10 Reputation points Microsoft External Staff Moderator

2026-08-06T16:09:54.0866667+00:00

Hello @Jonah Wermter

Just follow up on our previous conversation and check if you had an opportunity to review the information shared. If you have any questions or concerns please feel free to let me know.

Answer 1

The gateway is in an active migration state, and Azure blocks all configuration changes while that state remains in progress. That matches the CannotMakeChangesToGatewayDuringMigration error and explains why NAT rule creation, tag updates, and other write operations fail even though traffic continues to pass.

Supported remediation steps:

In the Azure portal, open the virtual network gateway resource.
Go to Settings > Configuration.
If the Migrate tab is available, use it to check the current migration state.
If validation shows the migration did not complete correctly, use Abort to roll back the migration state.
- After a successful abort, gateway changes should be allowed again.
- If traffic validation is successful and the migration is actually ready to finish, use Commit instead.
After the migration state is cleared, retry the required gateway change.

Important constraints during migration:

Do not modify the public IP, VPN gateway configuration, gateway subnet, or connections while the gateway is between Execute and Commit.
Do not enable DDoS protection or other advanced features during that phase.
Making changes during migration can leave the gateway in an unsupported or stuck state.

Checks before retrying migration:

Ensure the GatewaySubnet has at least three available IP addresses in the current prefix.
If the subnet is /28 or smaller, migration can fail. In that case, add multiple prefixes to the gateway subnet before retrying.

If the gateway entered a stuck or unrecoverable migration state because changes were made during migration, the documented worst-case recovery is to delete and recreate the gateway. Risk: this causes downtime, and if done through manual recreation the public IP address changes.