Switch appliance in Azure Site recovery.

Question

Switch appliance in Azure Site recovery.

Sravani, Bodula 0

I have a old appliance which is currently critical(all its components are critical and the machine is powered off). I have some protected servers using this old appliance. I have deployed a new appliance which is healthy. Now i would like to switch those servers(which are protected by old appliance) to be managed by new appliance. In the ASR UI with switch appliance i need to select the protected servers and give credentials to access the VM. I have added the physical server credentials to access the VM in new appliance but its now showing up in Switch appliance blade, but the credentials are appearing if go to replicate UI view.

I want to know if anyone faced the same strange issue, or Am i missing anything? Please help if you have faced similar issue and what steps taken to resolve.

Thank you

Sravani, Bodula 0 Reputation points

2026-03-17T11:06:24.9933333+00:00

I can see the servers(protected by old appliance) their replication status is critical but the status is protected. When i give choose switch appliance option on the old appliance , it shows all the protected vms and i choose a VM to switch in the next blade its asking for target appliance(which is new one) then for credentials. I have these credentials added in new applinace using applinace configuration manager.

I am quite confused about this part "adding the credentials" from azure portal cause i don't see that option anywhere in azure portal. i have ASR vault -> manage -> site recovery infra -> choose ASR replication applinaces under "For VMware & Physical machines" i dont see the options you were refering(Site Recovery infrastructure → replication appliance → Configure servers). Please guide me,
Bharath Y P 7,240 Reputation points Microsoft External Staff Moderator

2026-03-17T11:26:55.99+00:00
Azure Site Recovery (ASR) currently does not expose a direct “add credentials” option in the portal under Site Recovery Infrastructure > Replication Appliances. Credentials must be added through the Configuration Manager of the appliance itself, and only then do they appear in workflows like Replicate or Switch Appliance. The confusion comes from the fact that the portal blades show credentials inconsistently depending on which workflow you’re in.

Credentials for VMware/physical servers are added via the Appliance Configuration Manager (on-premises, not in the Azure portal).

Portal Behavior:

In the Replicate blade, credentials appear once synced from the appliance.

In the Switch Appliance blade, credentials only show if they are correctly associated with the target appliance and synced.

The portal does not have a “Configure Servers > Add Credentials” option for replication appliances. That’s why you don’t see it under Site Recovery Infrastructure.

To Resolve this:

Verify Appliance Registration

Go to ASR Vault > Site Recovery Infrastructure > Replication Appliances.

Ensure the new appliance shows as Healthy.

Re-add Credentials via Appliance Manager

On the new appliance VM, open Appliance Configuration Manager.

Add the physical server/VM credentials there.

Wait for synchronization (can take several minutes).

Refresh in Portal

In the portal, refresh the Switch Appliance blade.

The credentials should now appear under the target appliance.

If Still Missing

Restart ASR services on the new appliance.

As a fallback, use Re-protect instead of Switch Appliance. This re-establishes replication under the new appliance, though it may require reseeding.
Sravani, Bodula 0 Reputation points

2026-03-17T12:51:13.5566667+00:00

Thank you for responding. I have tried this but it didn't work out and there is no re-protect option enabled as the status is critical.

So we are going for fresh replication by new appliance.
Sravani, Bodula 0 Reputation points

2026-03-19T15:06:06.1033333+00:00

Hi, I would very much like to know what I experienced is a some sort of a bug and if I retry again it might work out?
I would like to know if anyone else tried this switch appliance and got the credentials where one of the appliance is burnt down so you deploy a fresh one and add credentials and moved the protected items with private endpoint connectivity. I mean its strange that the same credentials associated the same appliance appear in replicated blade and not in switch appliance blade.

I want to have the solution ready if it happens again cause I cannot keep on start replication from beginning.
Bharath Y P 7,240 Reputation points Microsoft External Staff Moderator

2026-03-20T09:32:50.85+00:00
In Azure Site Recovery, Enable Replication / Replicate blade Pulls credentials from the appliance’s stored credential list. Switch appliance blade does not use stored credentials, requires credentials to be entered at switch time. This is especially true when the old appliance is burnt down. When the current replication appliance has burnt down, credentials must be re‑entered during the switch operation and are not auto‑selected from the appliance credential store.

Using Private Link / Private Endpoints does not change credential visibility, but it does make validation stricter:

The new appliance must already:

Reach the source machines

Resolve private DNS correctly

Have required ports open (443 / 9443)

Otherwise, even valid credentials will silently fail to appear usable during switch

Private endpoint replication is supported, but only if all private links and DNS are already functional before the switch.

https://learn.microsoft.com/en-us/azure/site-recovery/azure-to-azure-how-to-enable-replication-private-endpoints
Sravani, Bodula 0 Reputation points

2026-03-20T09:43:05.0233333+00:00

Thanks for the response.
This is the confusing part where do we need to give the credentials. when I choose switch appliance operation on burnt down appliance it asks me to select existing protected servers. I select and move to next blade then it asks to choose for the target appliance in dropdown (lists existing healthy appliances ) I choose the freshly registered one,, next is to select the credentials for VM access in dropdown but there are no items available. My question is where are these credentials coming from, is it from the selected target appliance? Cause it doesn't ask to provide/ re-enter the credentials during the operation. It just shows an empty dropdown. So where should I add them? its not prompting/asking for one in the switch blade. Hope my problem is clear here.
Bharath Y P 7,240 Reputation points Microsoft External Staff Moderator

2026-03-20T15:18:23.9133333+00:00
Where credentials come from: The dropdown you’re seeing is populated from credentials that have already been added to the Recovery Services vault (Site Recovery > Credentials). These credentials are not automatically pulled from the target appliance. Instead, they must be pre‑registered in the vault before you attempt the switch appliance operation.

If no VM access credentials (Windows/Linux OS credentials such as domain admin or local admin accounts) have been added to the vault beforehand, the dropdown will appear empty. This is why the workflow does not prompt you to re‑enter credentials during the switch it assumes credentials are already stored and selectable.

You need to add the credentials under Recovery Services vault > Site Recovery > Credentials. Here, you register the VM OS access credentials that Azure Site Recovery uses to authenticate with the protected servers during reprotect and appliance‑related operations. Once added, these credentials become available for selection during the switch appliance flow.

Register the new (healthy) appliance

Add VM OS credentials in Recovery Services vault > Site Recovery > Credentials

Start the Switch appliance operation

Select protected servers

Select the target appliance

The credentials dropdown now lists the pre‑added credentials
Bharath Y P 7,240 Reputation points Microsoft External Staff Moderator

2026-03-24T13:47:39.2166667+00:00

I just wanted to kindly follow up to check, If the provided answer is helpful, it would be great if you could accept the answer and up-vote. This helps other community members who might face the same issue. Thanks
Sravani, Bodula 0 Reputation points

2026-03-31T07:41:07.0666667+00:00

Hi sir,

I have checked the Azure Recovery Services vault portal but I don't see anywhere that taking credentials. I might sure if this is different modernised UI and classic UI, but unfortunately I don't see it in my portal. It would be helpful if you have similar set up and showcase it here if possible.

Thank you.
Bharath Y P 7,240 Reputation points Microsoft External Staff Moderator

2026-03-31T10:32:10.7966667+00:00
The vault credentials are downloaded from vault:

the Recovery Services vault’s Backup blade

(Getting started / Prepare infrastructure)

Download vault credentials).

In the modern Azure portal the link is under Recovery Services vault > Backup > Prepare infrastructure > Download vault credentials (the Quick Start page can be hidden; use the Backup blade).

The modern portal moved the Quick Start download into the Backup > Prepare infrastructure flow; it is no longer a prominent button on the vault overview in some layouts. If you looked only at the Overview page and not the Backup blade, the download link can be missed

2 answers

Your answer

Sravani, Bodula 0 Reputation points

2026-03-17T11:06:24.9933333+00:00

I can see the servers(protected by old appliance) their replication status is critical but the status is protected. When i give choose switch appliance option on the old appliance , it shows all the protected vms and i choose a VM to switch in the next blade its asking for target appliance(which is new one) then for credentials. I have these credentials added in new applinace using applinace configuration manager.

I am quite confused about this part "adding the credentials" from azure portal cause i don't see that option anywhere in azure portal. i have ASR vault -> manage -> site recovery infra -> choose ASR replication applinaces under "For VMware & Physical machines" i dont see the options you were refering(Site Recovery infrastructure → replication appliance → Configure servers). Please guide me,
Bharath Y P 7,240 Reputation points Microsoft External Staff Moderator

2026-03-17T11:26:55.99+00:00

Azure Site Recovery (ASR) currently does not expose a direct “add credentials” option in the portal under Site Recovery Infrastructure > Replication Appliances. Credentials must be added through the Configuration Manager of the appliance itself, and only then do they appear in workflows like Replicate or Switch Appliance. The confusion comes from the fact that the portal blades show credentials inconsistently depending on which workflow you’re in.

Credentials for VMware/physical servers are added via the Appliance Configuration Manager (on-premises, not in the Azure portal).

Portal Behavior:

In the Replicate blade, credentials appear once synced from the appliance.

In the Switch Appliance blade, credentials only show if they are correctly associated with the target appliance and synced.

The portal does not have a “Configure Servers > Add Credentials” option for replication appliances. That’s why you don’t see it under Site Recovery Infrastructure.

To Resolve this:

Verify Appliance Registration

Go to ASR Vault > Site Recovery Infrastructure > Replication Appliances.

Ensure the new appliance shows as Healthy.

Re-add Credentials via Appliance Manager

On the new appliance VM, open Appliance Configuration Manager.

Add the physical server/VM credentials there.

Wait for synchronization (can take several minutes).

Refresh in Portal

In the portal, refresh the Switch Appliance blade.

The credentials should now appear under the target appliance.

If Still Missing

Restart ASR services on the new appliance.

As a fallback, use Re-protect instead of Switch Appliance. This re-establishes replication under the new appliance, though it may require reseeding.
Sravani, Bodula 0 Reputation points

2026-03-17T12:51:13.5566667+00:00

Thank you for responding. I have tried this but it didn't work out and there is no re-protect option enabled as the status is critical.

So we are going for fresh replication by new appliance.
Sravani, Bodula 0 Reputation points

2026-03-19T15:06:06.1033333+00:00

Hi, I would very much like to know what I experienced is a some sort of a bug and if I retry again it might work out?
I would like to know if anyone else tried this switch appliance and got the credentials where one of the appliance is burnt down so you deploy a fresh one and add credentials and moved the protected items with private endpoint connectivity. I mean its strange that the same credentials associated the same appliance appear in replicated blade and not in switch appliance blade.

I want to have the solution ready if it happens again cause I cannot keep on start replication from beginning.
Bharath Y P 7,240 Reputation points Microsoft External Staff Moderator

2026-03-20T09:32:50.85+00:00

In Azure Site Recovery, Enable Replication / Replicate blade Pulls credentials from the appliance’s stored credential list. Switch appliance blade does not use stored credentials, requires credentials to be entered at switch time. This is especially true when the old appliance is burnt down. When the current replication appliance has burnt down, credentials must be re‑entered during the switch operation and are not auto‑selected from the appliance credential store.

Using Private Link / Private Endpoints does not change credential visibility, but it does make validation stricter:

The new appliance must already:

Reach the source machines

Resolve private DNS correctly

Have required ports open (443 / 9443)

Otherwise, even valid credentials will silently fail to appear usable during switch

Private endpoint replication is supported, but only if all private links and DNS are already functional before the switch.

https://learn.microsoft.com/en-us/azure/site-recovery/azure-to-azure-how-to-enable-replication-private-endpoints
Sravani, Bodula 0 Reputation points

2026-03-20T09:43:05.0233333+00:00

Thanks for the response.
This is the confusing part where do we need to give the credentials. when I choose switch appliance operation on burnt down appliance it asks me to select existing protected servers. I select and move to next blade then it asks to choose for the target appliance in dropdown (lists existing healthy appliances ) I choose the freshly registered one,, next is to select the credentials for VM access in dropdown but there are no items available. My question is where are these credentials coming from, is it from the selected target appliance? Cause it doesn't ask to provide/ re-enter the credentials during the operation. It just shows an empty dropdown. So where should I add them? its not prompting/asking for one in the switch blade. Hope my problem is clear here.
Bharath Y P 7,240 Reputation points Microsoft External Staff Moderator

2026-03-20T15:18:23.9133333+00:00

Where credentials come from: The dropdown you’re seeing is populated from credentials that have already been added to the Recovery Services vault (Site Recovery > Credentials). These credentials are not automatically pulled from the target appliance. Instead, they must be pre‑registered in the vault before you attempt the switch appliance operation.

If no VM access credentials (Windows/Linux OS credentials such as domain admin or local admin accounts) have been added to the vault beforehand, the dropdown will appear empty. This is why the workflow does not prompt you to re‑enter credentials during the switch it assumes credentials are already stored and selectable.

You need to add the credentials under Recovery Services vault > Site Recovery > Credentials. Here, you register the VM OS access credentials that Azure Site Recovery uses to authenticate with the protected servers during reprotect and appliance‑related operations. Once added, these credentials become available for selection during the switch appliance flow.

Register the new (healthy) appliance

Add VM OS credentials in Recovery Services vault > Site Recovery > Credentials

Start the Switch appliance operation

Select protected servers

Select the target appliance

The credentials dropdown now lists the pre‑added credentials
Bharath Y P 7,240 Reputation points Microsoft External Staff Moderator

2026-03-24T13:47:39.2166667+00:00

I just wanted to kindly follow up to check, If the provided answer is helpful, it would be great if you could accept the answer and up-vote. This helps other community members who might face the same issue. Thanks
Sravani, Bodula 0 Reputation points

2026-03-31T07:41:07.0666667+00:00

Hi sir,

I have checked the Azure Recovery Services vault portal but I don't see anywhere that taking credentials. I might sure if this is different modernised UI and classic UI, but unfortunately I don't see it in my portal. It would be helpful if you have similar set up and showcase it here if possible.

Thank you.
Bharath Y P 7,240 Reputation points Microsoft External Staff Moderator

2026-03-31T10:32:10.7966667+00:00

The vault credentials are downloaded from vault:

the Recovery Services vault’s Backup blade

(Getting started / Prepare infrastructure)

Download vault credentials).

In the modern Azure portal the link is under Recovery Services vault > Backup > Prepare infrastructure > Download vault credentials (the Quick Start page can be hidden; use the Backup blade).

The modern portal moved the Quick Start download into the Backup > Prepare infrastructure flow; it is no longer a prominent button on the vault overview in some layouts. If you looked only at the Overview page and not the Backup blade, the download link can be missed

Answer 1

Hello Sravani, it sounds like you’ve built a fresh ASR replication appliance (RA2) and want to move your on-prem servers off the old, powered-off appliance (RA1) onto it, but you aren’t seeing any machines in the Switch appliance blade even though you’ve added credentials. A few things to check and try:

Make sure you’re kicking off the Switch appliance action from RA1 (the critical/offline appliance)
- Go to Recovery Services vault → Site Recovery infrastructure → ASR replication appliance
- Select your old appliance (RA1) and click Switch appliance
Verify the servers are actively replicating under RA1
- Only machines in a “Replicating” state from on-prem to Azure will show up here
- If replication is paused/failed or the machines have moved, they won’t be listed
Because RA1 is “burnt down” (all components critical), you must re-enter valid OS credentials
- Under RA2, go to Manage physical & virtual servers (or Site Recovery infrastructure → replication appliance → Configure servers)
- Add the same credentials here—these accounts need local admin rights on those servers
- Once RA2 can authenticate, it will install/update the mobility agent pointing at itself
Check network connectivity and firewall/AV rules between RA2 and your servers
- Required ports (443 and 9443) must be open
- No deep packet inspection or proxy should be blocking the channel
After you’ve configured the servers on RA2 and validated credentials, retry the Switch appliance workflow
- You should now see your protected servers in the “Select machines” list

If you still don’t see them, here are a few follow-up questions to dig deeper:

• Are your servers showing under Configure servers on the new appliance (RA2)?

• What OS versions/builds are the physical machines running?

• Do those VMs/servers show as healthy or paused in the Replicated Items view?

• Any errors in the mobility service or ASR event logs on the source machines?

• Did you add credentials via the Portal or via PowerShell?

Hope this helps you surface the missing piece. Let me know what you find!

References:

• Switch Azure Site Recovery replication appliance – https://learn.microsoft.com/azure/site-recovery/switch-replication-appliance-modernized

• Best practices for ASR replication appliance – https://learn.microsoft.com/azure/site-recovery/replication-appliance-support-matrix

• Deploy Azure Site Recovery replication appliance (Modernized) – https://learn.microsoft.com/azure/site-recovery/deploy-vmware-azure-replication-appliance-modernized

Answer 2

In the modernized Azure Site Recovery model, credentials used during a Switch appliance operation are supplied in the portal at switch time and are not taken from the appliance’s stored “physical server credentials” list. This is why credentials added on the new appliance appear in the Enable/Replicate workflow but not as a selectable list in the Switch appliance blade.

Key points from the documented behavior:

Switch appliance workflow
- In the vault, go to Site Recovery infrastructure → ASR replication appliance.
- Select the old (critical) appliance and choose Switch appliance.
- On Select machines, pick the protected machines that were using the old appliance.
- On Source settings, for each selected machine, choose the new (healthy) replication appliance.
- If the current appliance has “burnt down” (powered off/critical), the portal will require credentials to access the machines; otherwise, the credentials field is disabled.
- These credentials are entered directly in this blade; they are not pulled from the appliance’s stored credential list.
Why credentials appear in Replicate but not in Switch
- When enabling replication for physical servers, credentials are pre‑added to the appliance (via Provide Physical server details → Add credentials) and then selected in the Enable Replication → Source settings step.
- That credential store is used for discovery and for pushing the mobility agent during Enable Replication.
- The Switch appliance flow is different: it only exposes a credentials input when the old appliance is unavailable, and it does not enumerate the appliance’s stored credential objects as a list. Instead, credentials are provided ad‑hoc in the switch UI.
What to do in this scenario
- Proceed with Switch appliance as designed:
  - Select the affected machines.
  - On Source settings, select the new appliance for each machine.
  - When prompted (because the old appliance is critical), manually enter valid OS credentials for each VM so the new appliance can access it.
- There is no documented requirement or mechanism for the credentials added on the new appliance to appear as a selectable list in the Switch appliance blade, so nothing is missing in configuration.

If scripted automation is needed instead of the portal, the Start-AzRecoveryServicesAsrSwitchAppliance cmdlet can be used and accepts a -CredentialsToAccessVm parameter, again indicating that credentials are passed at switch time rather than taken from the appliance credential store.

References:

Share via

Switch appliance in Azure Site recovery.

2 answers

Your answer