Symptom
When an out-of-place VM is restored to a different region under the same subscription, the restore might fail if the Azure virtual client is authenticated with Managed Identity.
Cause
During an out-of-place VM restore job of an encrypted VM to a different region, the restore process will automatically create a new Key Vault with the name format, [SourceKeyVaultName+RegionName]. After successfully creating the Key Vault during the restore job, the restore job will automatically assign the required minimum permission for the Azure AD application to restore the backed up keys and secrets. However, this is not possible if the Azure virtual client is created using Managed Identity. The job might fail with the following error.
Error Code: [91:79]
Description: Unable to create a new virtual machine [MSICU] on host [centralrg] datastore [centralrgdiag]. [Failed to setup encryption settings for the VM]
Source: AzureProxyV2CS, Process: vsrst
Resolution
-
Find the key vault. Its name has the format [SourceKeyvaultname+regionname].
-
Assign the required permissions. For information, see Role and Permission Requirements for Protecting Azure Resources.
-
Retry the restore job.