Azure Edition VM on Azure Local migrated via Azure Migrate: "Activate Windows by enabling Azure benefits" although AVMA shows Licensed (AzureMetadataResponse = 4294967295, LicenseImdsIntegration fails with 0x800B0004)

Environment

• Azure Local, 2 nodes, version/build: 12.2609.1003.7 OS Build 26100
• Guest: Windows Server 2025 Datacenter: Azure Edition, build 26100, Generation 2, Secure Boot on, no vTPM
• VM was migrated with Azure Migrate. Before that it ran on a different Azure Local cluster on the same hardware (the cluster was rebuilt).
• Azure Hybrid Benefit: Activated on the cluster

Problem

After sign-in the VM shows "Activate Windows by enabling Azure benefits" (your VM has been deactivated because you are not running on Azure or a supported Azure Stack hypervisor...). Settings > System > Activation shows "Not active".

What works / what the host side shows

• slmgr /dlv: License Status Licensed, channel VIRTUAL_MACHINE_ACTIVATION, automatic VM activation is renewed (seen from both nodes).
• Get-AzStackHCIVMAttestation: VM status Connected, SupportedVersions {V2}.
• WAC / portal: VM shows Active, no recommended action.
• Guest Service Interface is enabled.

Comparison with a new VM

I created a new Azure Edition VM through the portal on the same cluster. Hyper-V configuration is identical (config version 12.0, Gen 2, same Secure Boot template, one NIC on the same converged switch, no vTPM). Both VMs are domain-joined. The new VM shows no message and Settings says Active.

Differences found in the guest

• Get-CimInstance -ClassName SoftwareLicensingService | Select AzureMetadataResponse new VM: 1, affected VM: 4294967295
• Scheduled task \Microsoft\Windows\Clip\LicenseImdsIntegration new VM: LastTaskResult 0, affected VM: 2148204548 (0x800B0004), runs about 30 seconds, reproducible when started manually
• The CAPI2 log shows fclip.exe building the certificate chain for metadata.azurestackhci.azure.com successfully on the affected VM (Result 0, chain up to DigiCert Global Root G2). The task still fails afterwards.

What I already checked (same result on both VMs)

• ctldl.windowsupdate.com reachable (authrootstl.cab, disallowedcertstl.cab), DisableRootAutoUpdate policy not set
• CRL/OCSP endpoints (crl3/crl4/ocsp.digicert.com, crl.microsoft.com, oneocsp.microsoft.com) reachable on port 80
• no proxy
• metadata.azurestackhci.azure.com does not resolve in DNS on either VM, 169.254.169.254 attested document request times out on both. So this does not seem to be the path used.
• Enabling a vTPM did not help, and it broke live migration (certificates for the local key protector missing on the other node), so I reverted it.
• The host side Get-AzStackHCIAttestation initially showed Error on both nodes. Enable-AzStackHCIAttestation -AddVM failed with "Access is denied" when opening a PSSession to localhost (WinRM). I enabled Azure benefits through WAC afterwards. This is still unresolved on the nodes, but the new VM works.

Questions

1. What does LicenseImdsIntegration / fclip.exe validate after building the chain, and what does 0x800B0004 mean in this context?
2. Is there a supported way to reset or re-register the guest-side attestation state of a migrated VM (without rebuilding it)?
3. Could leftovers from the previous cluster (Arc agent registration, guest agent configuration) cause this?
4. Is an in-place repair supported for Azure Edition on Azure Local, and with which media?

Happy to provide additional logs.

Best Regards

Gary