Azure Site Recovery Updates with Private endpoint.

Question

Azure Site Recovery Updates with Private endpoint.

L, Tony 0

Does anyone know how we're expected to actually update the ASR/Mobility Service agent when a private endpoint is in use these days?

Used to be the Github (https://github.com/Azure/Azure-SiteRecovery/tree/main/MobilityAgent/OnPremiseToAzure) would have the windows installers but they haven't included any new windows installers in the last 3 versions.

This thread https://learn.microsoft.com/en-us/answers/questions/5809455/roll-up-83-v9-66-7691-1-of-the-mobility-service-ag

mentions finding it in both the Microsoft download center or the azure tenant under prepare infrastructure but that isn't accurate either. Prepare Infrastructure just gives you a new OVA template for the appliance (no mobility service options) and the Microsoft download center has nothing for "Azure Site Recovery Update Rollup 83" All of the documentation just loops back to itself.

Bharath Y P 10,180 Reputation points Microsoft External Staff Moderator

2026-06-25T13:09:01.1966667+00:00
Hello Tony,

Updating the Azure Site Recovery (ASR) Mobility Service agent when using a private endpoint can be confusing due to recent changes in distribution and documentation. Here’s how you can update the agent in your scenario:

1. Download the Latest Mobility Service Agent

From the Azure Portal:

Go to your Recovery Services vault.

In the left pane, select Site Recovery Infrastructure.

Under For On-premises machines, select Prepare infrastructure.

In the Prepare infrastructure blade, look for the Mobility Service section.

Here, you should see download links for the latest Mobility Service installer for Windows and Linux.

Note: The OVA template is for the configuration server/appliance. The Mobility Service agent installers are typically available as separate downloads in this section.

If not visible in the portal: Sometimes, the portal UI changes or the links may not be immediately visible. In that case, you can:

Go to the Replicated Items blade.

Select a protected VM.

In the VM details, under Mobility Service, there may be a link to download the latest agent.

Direct Download (if available):

The GitHub repository is no longer updated with the latest Windows installers.

The Microsoft Download Center sometimes lags behind the latest releases.

If neither source has the latest, the Azure Portal is the authoritative source.

2. Updating the Agent on Protected Machines

Once you have the installer, you can manually update the agent on your VMs.

For environments with private endpoints, ensure that your VMs can reach the required Azure URLs for agent updates, or use the offline installer you downloaded.

3. Documentation References

Azure Site Recovery: Update Mobility Service

Prepare infrastructure for disaster recovery of VMware VMs to Azure

Additional Notes

If you are using a configuration server/appliance, it can also push updates to the Mobility Service agent, provided network connectivity is in place.

If you continue to face issues with finding the installer, consider opening a support ticket with Microsoft, as there may be a temporary issue with the portal or backend distribution. Kindly check the below documentation for more details: How to create an Azure support request - Azure supportability | Microsoft Learn

Let us know if you need more detailed steps for your specific environment or run into any issues during the update process.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
L, Tony 0 Reputation points

2026-06-25T13:44:31.6033333+00:00
Hello,

I'm not sure why my previous message was automatically deleted so I'll have to post it again. Bharath thank you for your added input however the options listed do not unfortunately assist.

Site Recovery Infrastructure does not have a "Prepare infrastructure" menu blade There IS an option for "Prepare infrastructure" under the "Getting Started" > "Site Recovery" blade however there is only an option to download the OVA template and Register the appliance. Nothing about Mobility Services

As previously mentioned, selecting a VM does not allow you to download any items. It simply says it must be done manually.

If there was a free option to open a support ticket with Microsoft I would. However, I don't feel I should need to pay for a support plan when all I need is a valid download link for an update I'm already paying for. Is there a way to open a ticket without the support plan if these options are indeed the only way to update?

1 answer

Your answer

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
L, Tony 0 Reputation points

2026-06-25T13:44:31.6033333+00:00

Hello,

I'm not sure why my previous message was automatically deleted so I'll have to post it again. Bharath thank you for your added input however the options listed do not unfortunately assist.

Site Recovery Infrastructure does not have a "Prepare infrastructure" menu blade There IS an option for "Prepare infrastructure" under the "Getting Started" > "Site Recovery" blade however there is only an option to download the OVA template and Register the appliance. Nothing about Mobility Services

As previously mentioned, selecting a VM does not allow you to download any items. It simply says it must be done manually.

If there was a free option to open a support ticket with Microsoft I would. However, I don't feel I should need to pay for a support plan when all I need is a valid download link for an update I'm already paying for. Is there a way to open a ticket without the support plan if these options are indeed the only way to update?

Answer 1

Hello L, Tony,

Greetings! Thanks for raising this question in the Q&A forum.

The confusion here comes from mixing up two different delivery paths for the Mobility Service agent. The GitHub repo and the Microsoft Download Center are meant for manual installs on machines that are not yet protected or for air gapped environments where you need to push the MSI yourself. Neither of those channels is the supported path once a private endpoint is involved, and Microsoft has not been consistently publishing standalone MSIs there for every recent rollup, which is why you are hitting dead ends.

For machines that are already protected through Azure Site Recovery, including those connected through a private endpoint, the agent update is pushed through the existing replication channel rather than through a public download.

Use the in-portal Update Agent action

In the Azure portal, open your Recovery Services vault, then go to Protected items then Replicated items, and select the VM you want to update. On the VM overview page, the Agent status field shows Update available or Critical Upgrade when a newer Mobility Service version exists. Selecting it and choosing Update Agent pushes the new agent binaries to that machine through the same secured channel used for replication traffic, which already works correctly over the private endpoint since it does not need a separate public internet path to a download server.

Confirm the private endpoint covers the right sub resources

For the push update to succeed, the private endpoint on your Recovery Services vault needs the siterecovery sub resource enabled in addition to the usual blob, queue, and table ones. If only storage related sub resources were configured, the agent push can silently fail and look like there is no update path at all.

az network private-endpoint-connection list --resource-group <YourResourceGroup> --name <YourPrivateEndpointName>

Check that the connection list includes the Site Recovery sub resource for your vault.

For configuration server or scale out process servers

If you are running the classic VMware/physical to Azure scenario rather than Azure to Azure, the configuration server and process server still need the Unified Setup installer for major version jumps, this one is documented and versioned per rollup, but the protected source machines underneath them get updated automatically once the configuration server itself is current, you do not need to manually push an MSI to each source server.

If Update Agent does not appear or fails

If the Update Agent button is missing or the job fails specifically in a private endpoint setup, this points to either a DNS resolution issue for the privatelink zone used by Site Recovery or an access restriction on the vault that is blocking the push channel itself rather than a missing download. At that point this needs vault side telemetry that is only visible to Microsoft, so please open a support request under Azure Support, choose Site Recovery as the service, and include the vault resource ID, the private endpoint resource ID, and the job ID of the failed Update Agent attempt.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.

L, Tony 0 Reputation points

2026-06-25T12:16:20.3366667+00:00

While I appreciate the information that's not how the portal behaves in its current state when a private endpoint is involved. You cannot use the portal to update any aspect of Azure Site Recovery. You are instead directed to manually update with the support flow pointing to the KB articles I've listed above. Some Further Details below.

Selecting Click to Install leads you to the below screen.

The "Learn More" just sends you to https://learn.microsoft.com/en-us/azure/site-recovery/upgrade-mobility-service-modernized#update-mobility-agent-when-private-endpoint-is-enabled

Scrolling down to the "Update Mobility Agent when Private endpoint is Enabled" tells you to confirm the availability of the new version and download it from https://learn.microsoft.com/en-us/azure/site-recovery/site-recovery-whats-new#supported-updates. However, if you look at these there are no links in any of the versions beyond rollup 80. (which leads to the GitHub which hasn't had updates for the windows installers beyond 80).

Version 83

Version 80