1672 - Workaround for block-based restore of Azure VMs and Storage Accounts

PAGE CONTENTS

• Before you begin
• Step 1: Find the Redstor app(s)
  • Step 2a: Create the custom role (first subscription only)
  • Step 2b: Add another subscription to the existing role (each additional subscription)
• Step 3: Assign the role to the Redstor app(s)
• Step 4: Retry the restore

Before you begin

Important: 

• If you are restoring into more than one subscription, you need to create the custom role once per tenant, because custom role names must be unique in a tenant. For each additional subscription, add that subscription to the existing role (Step 2b below) instead of creating it again, then perform Steps 1 and 3 on that subscription.
• You may see more than one “Redstor Azure Management” app. There is normally one app per protected subscription. More than one on the same subscription is rare and usually means the subscription was removed from Redstor and then added again (i.e. the old app was left behind), or that more than one Redstor account protects it.
  • If you see more than one "Redstor Azure Management" app listed on the subscription, assign the role to all of them, unless you know which app the failed restore used. In that case, you can assign the role to that app only.
• For cross-tenant restores, you will need to perform the workaround in the tenant and subscription you are restoring into, not the tenant and subscription the source VM is in.

Step 1: Find the Redstor app(s)

1. In the Azure portal, go to Subscriptions → the subscription you want to restore into → Access control (IAM) → Role assignments.
2. Search for Redstor Azure Management. The app is listed three times, once for each role it holds:
   • Virtual Machine Contributor
   • Disk Snapshot Contributor
   • Network Contributor
3. Note the ID in brackets after the app’s name. You’ll pick the same app/s in Step 3.

Step 2a: Create the custom role (first subscription only)

1. In Access control (IAM) of the relevant subscription you want to restore into, choose + Add → Add custom role.
2. Basics: Enter a name, for example CyberSentriq Storage Account Operator, and select Start from scratch. Choose Next.
3. Permissions: Choose + Add permissions, search for Microsoft.Storage, and open the Microsoft Storage card. 
   Tick:
   • Read: List/Get Storage Account(s)
   • Write: Create/Update Storage Account
   • Delete: Delete Storage Account
   • Other: List Storage Account Keys
4. Assignable scopes: This should already show the subscription you want to restore into. Leave it as it is.
5. Choose Review + create → Create.

Step 2b: Add another subscription to the existing role (each additional subscription)

1. Go to Access control (IAM) of the relevant subscription you want to restore into → Roles, filter Type to CustomRole, and choose … → Edit on your custom role.
2. Under Assignable scopes, choose Add assignable scopes and add the subscription.
3. Choose Review + create → Update.

Step 3: Assign the role to the Redstor app(s)

1. In Access control (IAM) of the relevant subscription you want to restore into, choose + Add → Add role assignment.
2. Role tab: Under Job function roles, search for CyberSentriq Storage Account Operator, select it, and choose Next.
3. Members tab: Choose User, group, or service principal → + Select members.
4. Search for Redstor Azure Management and select the app/s from Step 1. You can select several at once. Then choose Select.
5. If an Assignment type tab appears, choose Active and Permanent.
6. Choose Review + assign.

Step 4: Retry the restore

Wait 10 minutes for the new permissions to take effect, then retry the restore.