VPN Gateway: Basic IP Migration Fails During Prepare Phase

Question

VPN Gateway: Basic IP Migration Fails During Prepare Phase

Kourosh Tafreshi 0

Problem description

I am attempting to perform a Basic-to-Standard public IP migration on an Azure VPN Gateway, but the process fails during the Prepare phase. Each attempt to prepare the migration ends with an error indicating 'VmssGatewayDeploymentFailed: The gateway deployment operation failed due to an intermittent error,' after about two minutes. The failure occurs repeatedly, and the Abort operation succeeds, returning the gateway to its previous state. The same migration has succeeded on a staging gateway with similar configuration, so I suspect the issue may be related to capacity or specific to this gateway.

Environment

Azure VPN Gateway in West ***, SKU VpnGw4, active-passive, no BGP, Point-to-site configured with Microsoft Entra ID, migration scenario: Basic public IP to Standard public IP, GatewaySubnet /24, no additional subnet details available.

What I've already tried

I attempted the migration's Prepare step five times on 2026-10-18. Each attempt failed after about two minutes with the same error. After each failure, I ran the Abort operation, which succeeded. I compared this with a successful migration on a staging gateway in the same region on 2026-10-15. I also reviewed the GatewaySubnet configuration, confirmed there are enough IP addresses remaining, and checked the P2S profile's FQDN. No other diagnostic output or support exchanges are available beyond these steps.

Current status

I am seeking assistance to understand the root cause of the deployment failure during the Prepare phase, specifically whether capacity constraints or gateway-specific issues are causing the problem. I would appreciate guidance on how to resolve this issue to proceed with the IP migration.

0 comments

1 answer

Your answer

Answer 1

VmssGatewayDeploymentFailed during Prepare means the new gateway deployment did not complete, but the top-level message alone does not distinguish regional capacity from an unsupported configuration or gateway state.

Before another attempt, verify:

the existing gateway SKU is eligible for this migration path;
the GatewaySubnet has at least three free IP addresses;
no gateway update, connection change or previous migration operation is still running;
the migration state is clean;
you have exported the gateway configuration and any point-to-site VPN client package;
you have recorded the resource ID, region, SKU and exact UTC failure time.

Using the current Az.Network module, Prepare is normally invoked as follows:


$gateway = Get-AzVirtualNetworkGateway -Name '<gateway>' -ResourceGroupName '<resource-group>'

$params = New-AzVirtualNetworkGatewayMigrationParameter -MigrationType UpgradeDeploymentToStandardIP

Invoke-AzVirtualNetworkGatewayPrepareMigration -InputObject $gateway -MigrationParameter $params

Immediately after a failure, export the Azure Activity Log entry and capture its correlation ID and inner error. Because five retries already failed, I would stop repeating the operation: further retries are unlikely to reveal more and can complicate the timeline.

The Prepare stage provisions replacement resources; the Migrate stage is where the documented connectivity interruption is expected. A repeatable Prepare failure with a VMSS deployment error generally needs Azure Support to inspect the backend deployment/capacity record. If retaining the public IP is a requirement, do not delete and recreate the gateway as a workaround unless Microsoft Support confirms that recovery path.

Official guidance: