how to fix - Error ID110032 Error MessagePolicy configuration couldn't be performed for the policy migratevc-ofa011280sitepolicy.

Hello Ronald Chellappah,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are asking on how you can fix Error ID110032 - Error Message "Policy configuration couldn't be performed for the policy migratevc-ofa011280sitepolicy."

The failure is not caused by the source VM or by an incorrect migration policy design. It is caused by the Azure Migrate replication infrastructure being unable to access the required cache/replication storage account and/or Key Vault secret during the replication policy association stage. In confirmed scenarios, this commonly appears with provider error 31482 / HTTP 403 Forbidden, which indicates an authentication, authorization, SAS, Key Vault, storage firewall, or network access issue. - https://learn.microsoft.com/en-us/troubleshoot/azure/azure-storage/blobs/authentication/storage-troubleshoot-403-errors, and https://learn.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access gave more insights.

The best practice to resolve is to:

• Enable the system-assigned managed identity on the Azure Migrate-linked Recovery Services vault.
• Grant the vault managed identity, and the Azure Migrate project managed identity if present, the required permissions on the cache storage account.
• Grant the same identities the required Key Vault secret access.
• Validate storage networking, firewall, trusted services, Private Endpoint, and DNS configuration.
• Wait for RBAC propagation, then retry replication.

After the correct managed identity permissions, Key Vault access, and storage networking configuration are applied, the replication policy association should complete successfully and the affected VMs should proceed to initial replication.

Use the below official Microsoft resources for more reading and steps:

• https://learn.microsoft.com/azure/migrate/migrate-support-matrix
• https://learn.microsoft.com/azure/migrate/concepts-vmware-agentless-migration
• https://learn.microsoft.com/azure/migrate/troubleshoot-network-connectivity
• https://learn.microsoft.com/azure/migrate/migrate-vmware-servers-to-azure-using-private-link
• https://learn.microsoft.com/azure/storage/blobs/assign-azure-role-data-access
• https://learn.microsoft.com/troubleshoot/azure/azure-storage/blobs/authentication/storage-troubleshoot-403-errors
• https://learn.microsoft.com/azure/key-vault/general/rbac-guide

I hope this is helpful! Do not hesitate to let me know if you have any other questions, steps or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Hello Ronald Chellappah

Thank you for posting your query on Microsoft Q&A platform.

Error ID 110032 – "Policy configuration couldn't be performed for the policy migratevc‑<xxxxxx>sitepolicy" is raised at the replication policy association stage when the Recovery Services vault (created by Azure Migrate) is unable to access the cache/replication storage account that holds the replication data. In almost every confirmed case, the underlying provider error is 31482 / HTTP 403 Forbidden when the vault tries to read the SAS secret from Key Vault and access the storage account which means the vault's system‑assigned managed identity does not have the required data‑plane permissions on the cache storage account.

1. In the Azure portal, open the failed replication job (Azure Migrate → Servers, databases and web apps → Replicating servers → click the failed VM → Error Details).
2. Expand the error and check the Provider error code/message. If you see anything like:"Provider error code: 31482 - Attempt to verify access to storage account <name> using SAS token obtained via secret 'AzureStorageAccountSasSecretName' from Key Vault <name> failed with message: 'The remote server returned an error: (403) Forbidden.'" — that confirms the RBAC/permission gap on the cache storage account.

As a workaround, please follow below steps:

1. Identify the Recovery Services vault that Azure Migrate auto‑created for your project (Azure Migrate → Properties → linked Recovery Services vault).
2. Open that vault → Identity → make sure System assigned → Status = On. Copy the Object (principal) ID.
3. Identify the cache storage account used for replication (the one referenced in the error message — it usually starts with migratelsa… and lives in the Azure Migrate resource group).
4. Open the cache Storage account → Access control (IAM) → Add → Add role assignment and assign the following roles to the vault's managed identity (use the Object ID from step 2):
   • Contributor
   • Storage Blob Data Contributor Repeat the same role assignments for the Azure Migrate project's managed identity (Azure Migrate project → Identity → System assigned principal) this is what other community members confirmed was required in addition to the vault identity.
5. On the cache storage account → Networking, confirm one of the following so the vault can reach it:
   • Public network access = Enabled from all networks, or
   • Enabled from selected virtual networks and IP addresses with**"Allow Azure services on the trusted services list to access this storage account"** checked, and (if you use private endpoints) the Azure Migrate / ASR private endpoints configured per the doc below.
6. Wait a few minutes for the role assignment to propagate, then go back to Azure Migrate and click Restart replication on the affected VMs.

If you used Initialize-AzMigrateReplicationInfrastructure and the storage account/Key Vault were freshly created, you can also re‑run it to re‑create the SAS definition cleanly:

Initialize-AzMigrateReplicationInfrastructure `
    -ResourceGroupName <RG> `
    -ProjectName <ProjectName> `
    -Scenario agentlessVMware `
    -TargetRegion <Region>

Could you please share the Provider error code and full provider message from the failed job (Error Details page) so we can confirm whether it's the 31482/403 signature, or a different sub‑cause (for example a Deny‑effect Azure Policy on Storage/Key Vault)? Once you grant the roles above and retry, replication should move past the policy association stage.

Thanks,
Suchitra.