Search code examples
azure-backup-vault

ASR failover fails for Bitlocker encrypted VM

There is an Azure VM encrypted disk with Bitlocker in North Europe. Everything has replicated well in West Europe. While doing Test Failover, getting below error.

Failover Error: ID28031 Error Message: Virtual machine XXX-AZ-WEB01-test' could not be created under the resource group 'XXXX-Destination-RG'. Azure error message: 'Key Vault https://XXX-keyvault-ne.vault.azure.net/keys/Bitlocker/XXXX either has not been enabled for Volume Encryption or the vault id provided does not match /subscriptions/XXXX-XX-XXXX-XXX-XXXX/resourceGroups/XXX-Destination-RG/providers/Microsoft.KeyVault/vaults/XXX-KEYVAULT-WE's true resource id. (Provisioning failed)'.

Things are already in place what is showing in error.

  1. Volume encryption has enabled in both source and destination Key vault. enter image description here

  2. The user has assigned all the permission as per this doc.

Thanks in advance.

Solution

  • The mistake was that destination KeyVault was created and keys were imported manually. The destination Keyvault must be created by the script provided below.

    https://learn.microsoft.com/en-us/azure/site-recovery/azure-to-azure-how-to-enable-replication-ade-vms#copy-disk-encryption-keys-to-the-dr-region-by-using-the-powershell-script

    Once I created the destination KeyVault by script, everything goes smoothly.