Merge pull request #271187 from MaryMichael-MS/04AprAddFAQ

Added a FAQ.

Author: JamesJBarnett

articles/migrate/common-questions-appliance.md

@@ -7,7 +7,7 @@ ms.manager: abhemraj
 ms.service: azure-migrate
 ms.topic: conceptual
 ms.custom: engagement-fy24
-ms.date: 03/13/2024
+ms.date: 04/04/2024
 ---
 
 # Azure Migrate appliance: Common questions
@@ -147,6 +147,49 @@ By default, the appliance and its installed agents are updated automatically. Th
 
 Only the appliance and the appliance agents are updated by these automatic updates. The operating system is not updated by Azure Migrate automatic updates. Use Windows Updates to keep the operating system up to date.
 
+## How to troubleshoot Auto-update failures for Azure Migrate appliance?
+
+A modification was made recently to the MSI validation process, which could potentially impact the Migrate appliance auto-update process. The auto-update process might fail with the following error message:
+
+:::image type="content" source="./media/common-questions-appliance/auto-update-process-error-inline.png" alt-text="Screenshot of auto update process error." lightbox="./media/common-questions-appliance/auto-update-process-error-expanded.png":::
+
+To fix this issue, follow these steps to ensure that your appliance can validate the digital signatures of the MSIs:
+
+1. Ensure that the Microsoft’s root certificate authority certificate is present in your appliance’s certificate stores.
+    1. Go to **Settings** and search for ‘certificates’. 
+    1. Select **Manage Computer Certificates**. 
+    
+        :::image type="content" source="./media/common-questions-appliance/settings-inline.png" alt-text="Screenshot of Windows settings." lightbox="./media/common-questions-appliance/settings-expanded.png":::
+
+    1. In the certificate manager, you must see the entry for **Microsoft Root Certificate Authority 2011** and **Microsoft Code Signing PCA 2011** as shown in the following screenshots: 
+    
+        :::image type="content" source="./media/common-questions-appliance/certificate-1-inline.png" alt-text="Screenshot of certificate 1." lightbox="./media/common-questions-appliance/certificate-1-expanded.png":::
+
+        :::image type="content" source="./media/common-questions-appliance/certificate-2-inline.png" alt-text="Screenshot of certificate 2." lightbox="./media/common-questions-appliance/certificate-2-expanded.png":::
+
+    1. If these two certificates are not present, proceed to download them from the following sources:
+        - https://download.microsoft.com/download/2/4/8/248D8A62-FCCD-475C-85E7-6ED59520FC0F/MicrosoftRootCertificateAuthority2011.cer 
+        - https://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt
+    1. install these certificates on the appliance machine.
+1. Check if there are any group policies on your machine that could be interfering with certificate validation: 
+    1. Go to Windows Start Menu > Run > gpedit.msc. <br>The **Local Group Policy Editor** window. Make sure that the **Network Retrieval** policies are defined as shown in the following screenshot:
+    
+        :::image type="content" source="./media/common-questions-appliance/local-group-policy-editor-inline.png" alt-text="Screenshot of local group policy editor." lightbox="./media/common-questions-appliance/local-group-policy-editor-expanded.png":::
+
+1. Ensure that there are no internet access issues or firewall settings interfering with the certificate validation.
+
+**Verify Azure Migrate MSI Validation Readiness**
+
+1. To ensure that your appliance is ready to validate Azure Migrate MSIs, follow these steps:
+    1. Download a sample MSI from [Microsoft Download Center](https://download.microsoft.com/download/9/b/8/9b8abdb7-a784-4a25-9da7-31ce4d80a0c5/MicrosoftAzureAutoUpdate.msi) on the appliance.
+    1. Right-click on it and go to Digital Signatures tab. 
+        
+        :::image type="content" source="./media/common-questions-appliance/digital-sign-inline.png" alt-text="Screenshot of digital signature tab." lightbox="./media/common-questions-appliance/digital-sign-expanded.png":::
+
+    1. Select Details and check that the Digital Signature Information for the certificate is OK as highlighted in the following screenshot: 
+    
+        :::image type="content" source="./media/common-questions-appliance/digital-sign-inline.png" alt-text="Screenshot of digital signature tab." lightbox="./media/common-questions-appliance/digital-sign-expanded.png":::
+
 ## Can I check agent health?
 
 Yes. In the portal, go the **Agent health** page of the Azure Migrate: Discovery and assessment tool or the Migration and modernization tool. There, you can check the connection status between Azure and the discovery and assessment agents on the appliance.