Merge pull request #295571 from madhurinms/master

troubleshooting edits

Author: v-regandowner

articles/storage-mover/TOC.yml

@@ -46,11 +46,11 @@ items:
     items: 
     - name: Job run error codes
       href: status-code.md
+    - name: Collect a support bundle
+      href: troubleshooting.md
 - name: Resources
   items:
   - name: Monitor copy and job run logs
     href: log-monitoring.md
-  - name: Collect a support bundle
-    href: troubleshooting.md
   - name: Release notes
     href: release-notes.md

articles/storage-mover/media/troubleshooting/rbac.png

@@ -5,7 +5,7 @@ author: stevenmatthew
 ms.author: shaas
 ms.service: azure-storage-mover
 ms.topic: how-to
-ms.date: 06/12/2024
+ms.date: 03/30/2025
 ms.custom: template-how-to
 ---
 
@@ -36,7 +36,7 @@ An Azure Storage Mover agent uses string status codes for statuses that are conv
 Each of these scopes further divides statuses into categories and subcategories. Each subcategory typically reserves 20 status codes to accommodate future expansion.
 
 > [!TIP]
-> *AZSM0000* is the special scope-agnostic status code indicating successful operation. This should be used to signify successful operation at any scope/level.
+> *AZSM0000* is the special scope-agnostic status code indicating successful operation and should be used to signify successful operation at any scope/level.
 
 |Error Code                       |Error Message | Details/Troubleshooting steps/Mitigation |
 |---------------------------------|--------------|------------------------------------------|
@@ -56,9 +56,9 @@ Each of these scopes further divides statuses into categories and subcategories.
 | <a name="AZSM1029"></a>**AZSM1029** |Source endpoint type not supported by this agent version | This source type is unsupported by the current Storage Mover agent. |
 | <a name="AZSM1030"></a>**AZSM1030** |Cannot verify storage account type | Verify that the storage account and container exist, and that the agent has been granted permissions to them. |
 | <a name="AZSM1031"></a>**AZSM1031** |Failed to resolve target host | Review the network configuration. |
-| <a name="AZSM1040"></a>**AZSM1040** |Miscellaneous error while accessing target  | It's likely that this error is temporary. Retry the migration job again. If the issue persists, please create a support ticket for further assistance. |
-| <a name="AZSM1041"></a>**AZSM1041** |Failed to send job progress  | It's likely that this error is temporary. Retry the migration job again. If the issue persists, please create a support ticket for further assistance. |
-| <a name="AZSM1042"></a>**AZSM1042** |Failed to create job  | It's likely that this error is temporary. Retry the migration job again. If the issue persists, please create a support ticket for further assistance. |
+| <a name="AZSM1040"></a>**AZSM1040** |Miscellaneous error while accessing target  | It's likely that this error is temporary. Retry the migration job again. If the issue persists, create a support ticket for further assistance. |
+| <a name="AZSM1041"></a>**AZSM1041** |Failed to send job progress  | It's likely that this error is temporary. Retry the migration job again. If the issue persists, create a support ticket for further assistance. |
+| <a name="AZSM1042"></a>**AZSM1042** |Failed to create job  | It's likely that this error is temporary. Retry the migration job again. If the issue persists, create a support ticket for further assistance. |
 | <a name="AZSM1043"></a>**AZSM1043** |Failed to resume job  | Retry or create a support ticket. |
 | <a name="AZSM1044"></a>**AZSM1044** |Failed to finalize the job.  | Retry or create a support ticket. |
 | <a name="AZSM1045"></a>**AZSM1045** |Job was aborted while it was still running.  | Retry or create a support ticket. |
@@ -69,8 +69,35 @@ Each of these scopes further divides statuses into categories and subcategories.
 | <a name="AZSM2027"></a>**AZSM2027** |Source file security descriptor has unsupported properties  | Review the file's or folder's permissions. |
 | <a name="AZSM2061"></a>**AZSM2061** |Unknown Error encountered when scanning the source. |  This is probably a transient error. Rerun the migration job. |
 | <a name="AZSM2062"></a>**AZSM2062** |Failed to read source file due to permission issues. | Verify that the agent has been granted permissions to the source location. |
-| <a name="AZSM2063"></a>**AZSM2063** |Encountered I/O error while reading source file.  | It's likely that this error is temporary. Retry the migration job again. If the issue persists, please create a support ticket for further assistance. |
+| <a name="AZSM2063"></a>**AZSM2063** |Encountered I/O error while reading source file.  | It's likely that this error is temporary. Retry the migration job again. If the issue persists, create a support ticket for further assistance. |
 | <a name="AZSM2069"></a>**AZSM2069** |Failed to read target file due to permission issues.  | Verify that the agent has been granted permissions to the target location. |
 | <a name="AZSM2070"></a>**AZSM2070** |Cannot write blob because it has an active lease | This error may be caused by another agent writing to the location. Ensure no other job is running against the target. Retry or create support ticket. |
-| <a name="AZSM2071"></a>**AZSM2071** |Source file has been modified during transfer | It's likely that this error is temporary. Retry the migration job again. If the issue persists, please create a support ticket for further assistance. |
-| <a name="AZSM2080"></a>**AZSM2080** |Copy failed due to an unknown error  | It's likely that this error is temporary. Retry the migration job again. If the issue persists, please create a support ticket for further assistance. |
+| <a name="AZSM2071"></a>**AZSM2071** |Source file has been modified during transfer | It's likely that this error is temporary. Retry the migration job again. If the issue persists, create a support ticket for further assistance. |
+| <a name="AZSM2080"></a>**AZSM2080** |Copy failed due to an unknown error  | It's likely that this error is temporary. Retry the migration job again. If the issue persists, create a support ticket for further assistance. |
+
+## Troubleshooting Storage Mover RBAC issues
+
+During a job run, automatic RBAC assignments happen. If there are failures in assignments, manually add the required role assignment.
+
+1.	Navigate to the appropriate resource - Key Vault, File Share or Blob Container. 
+2.	Navigate to Access Control (IAM).
+3.	Add a new role assignment: [Assign Azure roles using the Azure portal - Azure RBAC | Microsoft Learn](/azure/role-based-access-control/role-assignments-portal).
+4.	In the Add role assignment wizard, search for the appropriate role in the table below for the resource type selected in step 1. In the below example the resource would be Key Vault.
+
+:::image type="content" source="media/troubleshooting/rbac.png" alt-text="Image showing the Key Vault resource successfully assigned roles." lightbox="media/troubleshooting/rbac.png":::
+
+|Resource Type                          |Roles required|
+|---------------------------------------|--------------|
+| <a name="Key Vault"></a>**Key Vault** |Key Vault Secrets User| 
+| <a name="File Share"></a>**File Share** |Storage File Data Privileged Contributor| 
+| <a name="Blob Container"></a>**Blob Container** |Storage Blob Data Privileged Contributor | 
+  
+i. Assign access should be for “Managed Identity”.<br />
+ii. On the right pane, select Managed Identity type as Machine – Azure Arc.<br />
+iii. Select the machine arc from the list. It is of the same name as the agent.<br />
+iv. Complete the assignment.<br />
+
+
+
+
+