Merging changes synced from https://github.com/MicrosoftDocs/azure-docs-pr (branch live)

Author: Learn Build Service GitHub App

articles/storage-mover/cloud-to-cloud-migration.md

@@ -1,14 +1,14 @@
 ---
-title: Get started with cloud-to-cloud migration in Azure Storage Mover (Preview)
-description: The Cloud-to-Cloud Migration feature (preview) in Azure Storage mover allows you to securely transfer data from Amazon Simple Storage Service (Amazon S3) to Azure Blob Storage, utilizing Azure Arc for AWS (Amazon Web Services) to simplify authentication and resource management.
+title: Get started with cloud-to-cloud migration in Azure Storage Mover
+description: The Cloud-to-Cloud Migration feature in Azure Storage mover allows you to securely transfer data from Amazon Simple Storage Service (Amazon S3) to Azure Blob Storage, utilizing Azure Arc for AWS (Amazon Web Services) to simplify authentication and resource management.
 author: stevenmatthew
 ms.author: shaas
 ms.service: azure-storage-mover
 ms.topic: quickstart
 ms.date: 07/01/2025
 ---
 
-# Get started with cloud-to-cloud migration in Azure Storage Mover (Preview)
+# Get started with cloud-to-cloud migration in Azure Storage Mover
 
 The Cloud-to-Cloud Migration feature in Azure Storage Mover allows you to securely transfer data from Amazon Simple Storage Service (Amazon S3) to Azure Blob Storage. 
 
@@ -25,12 +25,12 @@ Before you begin, ensure that you have:
 - An [Azure Storage account](../storage/common/storage-account-create.md) to use as the destination.
 - A [Storage Mover resource](storage-mover-create.md) deployed in your Azure subscription.
 
-## Preview limitations
+## Limits
 
-The Cloud-to-Cloud Migration feature in Azure Storage Mover is currently in preview. The following limitations apply:
+The Cloud-to-Cloud Migration feature in Azure Storage Mover has the following limits:
 
-- Each migration job supports the transfer of 10 million objects.
-- A maximum of 10 concurrent jobs is supported per subscription.
+- Each migration job supports the transfer of 500 million objects.
+- A maximum of 10 concurrent jobs is supported per subscription. If you need to run more than 10, you can do so by creating a support request.
 - Azure Storage Mover doesn't support automatic rehydration of archived objects. Data stored in AWS Glacier or Deep Archive must be restored before migration. Migration jobs should only be initiated after the data is fully restored.
 - Private Networking is currently not supported. However, Azure Storage Mover's Cloud-to-Cloud feature securely transfers data by limiting S3 access to trusted Azure IP ranges. This approach ensures secure, controlled connectivity over the public internet.
 

articles/storage-mover/status-code.md

@@ -5,7 +5,7 @@ author: stevenmatthew
 ms.author: shaas
 ms.service: azure-storage-mover
 ms.topic: how-to
-ms.date: 03/30/2025
+ms.date: 10/13/2025
 ms.custom: template-how-to
 ---
 
@@ -44,35 +44,35 @@ Each of these scopes further divides statuses into categories and subcategories.
 | <a name="AZSM1002"></a>**AZSM1002** |Encountered an error while scanning the source  | Retry or create a support ticket. |
 | <a name="AZSM1003"></a>**AZSM1003** |Failed to access source folder due to permission issues | Verify that the agent has been granted permissions to the source file share. |
 | <a name="AZSM1004"></a>**AZSM1004** |Source path provided is invalid | Create a new endpoint with a valid source share path and update the job definition and retry. |
-| <a name="AZSM1020"></a>**AZSM1020** |Miscellaneous error while accessing source  | Retry or create a support ticket. |
+| <a name="AZSM1020"></a>**AZSM1020** |Miscellaneous error while accessing source  | This error is reported for any reason that causes source file/folder read failures. Some of the errors could be "no such file or directory", “permission denied”, “input/output error”, etc. Ensure that the network connection between agent and the source share is working well. The source share/folder/files must be present and the agent should have read access to the source share. |
 | <a name="AZSM1021"></a>**AZSM1021** |Failed to access target folder due to permission issues  | Retry or create a support ticket. |
 | <a name="AZSM1022"></a>**AZSM1022** |Target path provided is invalid | Create a new endpoint with a valid target container and path and update the job definition and retry. |
 | <a name="AZSM1023"></a>**AZSM1023** |Lease expired for this agent on the target container  | Retry or create a support ticket. |
-| <a name="AZSM1024"></a>**AZSM1024** |Authorization failure accessing the target location | The agent doesn't have sufficient permission to access the target location. RBAC (role-based access control) role assignments are performed automatically when resources are created using the Azure portal. If you're using the APIs, PowerShell cmdlets, or SDKs, manually create a role assignment for the agent's managed identity to access the target location. For NFS, use the *Storage Blob Data Contributor* role assignment. For SMB, use *Storage File Data Privileged Contributor*. The [Assign an Azure role for access to blob data](/azure/storage/blobs/assign-azure-role-data-access) article may help resolve this issue. |
-| <a name="AZSM1025"></a>**AZSM1025** |Authentication failure accessing the source location | Verify that the agent has been granted permissions to the source location. |
-| <a name="AZSM1026"></a>**AZSM1026** |Target type is not supported by the agent | This target type is unsupported by the current Storage Mover agent. |
-| <a name="AZSM1027"></a>**AZSM1027** |The target location is busy | The agent can't access the target location because an existing lease is active. This error may be caused by another agent writing to the location. Ensure no other job is running against the target. Retry or create support ticket. |
-| <a name="AZSM1028"></a>**AZSM1028** |Key Vault access failure | Verify that the agent has been granted permissions to the relevant Key Vault. |
+| <a name="AZSM1024"></a>**AZSM1024** | Authorization failure accessing the target location | The agent doesn't have sufficient permission to access the target location. RBAC (role-based access control) role assignments are performed automatically when resources are created using the Azure portal. If you're using the APIs, PowerShell cmdlets, or SDKs, manually create a role assignment for the agent's managed identity to access the target location. For Storage Blob container target, use the *Storage Blob Data Contributor* role assignment. For Azure File share as target, use *Storage File Data Privileged Contributor*.  As an example, to assign RBAC role refer [Assign an Azure role for access to blob data](/azure/storage/blobs/assign-azure-role-data-access) article.  |
+| <a name="AZSM1025"></a>**AZSM1025** |Authentication failure accessing the source location | Verify that the agent has permissions to the source location. |
+| <a name="AZSM1026"></a>**AZSM1026** |Target type isn't supported by the agent | This target type is unsupported by the current Storage Mover agent. |
+| <a name="AZSM1027"></a>**AZSM1027** |The target location is busy | The agent can't claim the target share or container because an active lease exists. The lease may be due to another migration job or a previous aborted job still holding a claim on the file “AZURE_STORAGE_MOVER_MARKER”. Make sure no other job is running for this target. If none are running, restart the agent and try again; if the problem continues, contact support. |
+| <a name="AZSM1028"></a>**AZSM1028** |Key Vault access failure | This error can occur if the agent's managed identity lacks "Key Vault Secrets User" RBAC access, if firewalls, or network ACLs block connections to the key vault endpoint, or if secrets are missing. For a “RESPONSE 403” error, check role assignments and any firewall rules on the key vault that may restrict traffic. For other errors, use the xdmsh menu option "5) Test single endpoint connectivity" under “2) Network configuration” to verify endpoint reachability.  |
 | <a name="AZSM1029"></a>**AZSM1029** |Source endpoint type not supported by this agent version | This source type is unsupported by the current Storage Mover agent. |
 | <a name="AZSM1030"></a>**AZSM1030** |Cannot verify storage account type | Verify that the storage account and container exist, and that the agent has been granted permissions to them. |
-| <a name="AZSM1031"></a>**AZSM1031** |Failed to resolve target host | Review the network configuration. |
+| <a name="AZSM1031"></a>**AZSM1031** |Failed to resolve target host | Check the network configuration to confirm firewalls, or ACLs aren't blocking access to the storage account endpoint. Use the xdmsh menu option "5) Test single endpoint connectivity" under "2) Network configuration" to verify endpoint reachability. |
 | <a name="AZSM1040"></a>**AZSM1040** |Miscellaneous error while accessing target  | It's likely that this error is temporary. Retry the migration job again. If the issue persists, create a support ticket for further assistance. |
 | <a name="AZSM1041"></a>**AZSM1041** |Failed to send job progress  | It's likely that this error is temporary. Retry the migration job again. If the issue persists, create a support ticket for further assistance. |
-| <a name="AZSM1042"></a>**AZSM1042** |Failed to create job  | It's likely that this error is temporary. Retry the migration job again. If the issue persists, create a support ticket for further assistance. |
+| <a name="AZSM1042"></a>**AZSM1042** |Failed to create job  | This error may occur due to various reasons, such as the agent being unable to reach the storage account endpoint, firewalls, or network ACLs blocking the connection, traffic from the agent being routed over a public IP when a private endpoint is configured on the storage account, or a proxy modifying the certificate. To verify storage account endpoint reachability, use the xdmsh menu option "5) Test single endpoint connectivity" under "2) Network configuration". If the error reported is "x509: certificate signed by unknown authority," it indicates that the on-premises network is intercepting and altering SSL certificates (SSL Interception) for traffic to the required endpoints, causing the Agent not to recognize the received certificates. While adding certificates to the Agent would typically resolve this issue, this feature is currently unsupported. To enable the Agent to access these endpoints, consider adding them to the allowlist to bypass SSL Interception.  |
 | <a name="AZSM1043"></a>**AZSM1043** |Failed to resume job  | Retry or create a support ticket. |
 | <a name="AZSM1044"></a>**AZSM1044** |Failed to finalize the job.  | Retry or create a support ticket. |
 | <a name="AZSM1045"></a>**AZSM1045** |Job was aborted while it was still running.  | Retry or create a support ticket. |
-| <a name="AZSM1060"></a>**AZSM1060** |Miscellaneous error during job execution.  | Retry or create a support ticket. |
+| <a name="AZSM1060"></a>**AZSM1060** |Miscellaneous error during job execution.  |This error may occur due to various reasons. Review the reported error and take corrective actions based on its details as outlined below. If the error indicates:  1) "InvalidResourceName": Check that folder and file names follow supported naming conventions. For example, "con" isn't a valid directory name. 2) "The specified share is full": Verify the capacity of the target share.  3) "bad file descriptor": Confirm that the SMB network connection between the agent and source is functioning properly, and that the SMB server is responsive to read requests.  4) "403 This request isn't authorized to perform this operation": If a private endpoint is configured for the target storage account, check that DNS is correctly configured and verify there are no DNS misrouting or load balancer configurations causing incorrect IP resolution.  5) For other errors, retry the job; if the issue continues, create a support ticket. |
 | <a name="AZSM2021"></a>**AZSM2021** |File type not supported by target. | This target type does not support files of this type. Reference scalability and performance targets for [Azure Files](/azure/storage/files/storage-files-scale-targets) and [Azure Blob Storage](/azure/storage/blobs/scalability-targets) for additional information. |
 | <a name="AZSM2024"></a>**AZSM2024** |Source path length longer than max supported by target.  | Refer to guidance within the [Naming and referencing shares, directories, files, and metadata](/rest/api/storageservices/naming-and-referencing-shares--directories--files--and-metadata) article. |
 | <a name="AZSM2026"></a>**AZSM2026** |Source file has size larger than max supported by target.  | Refer to guidance within the [Naming and referencing shares, directories, files, and metadata](/rest/api/storageservices/naming-and-referencing-shares--directories--files--and-metadata) article. |
 | <a name="AZSM2027"></a>**AZSM2027** |Source file security descriptor has unsupported properties  | Review the file's or folder's permissions. |
-| <a name="AZSM2061"></a>**AZSM2061** |Unknown Error encountered when scanning the source. |  This is probably a transient error. Rerun the migration job. |
-| <a name="AZSM2062"></a>**AZSM2062** |Failed to read source file due to permission issues. | Verify that the agent has been granted permissions to the source location. |
+| <a name="AZSM2061"></a>**AZSM2061** |Unknown Error encountered when scanning the source. |  May be a transient error. Rerun the migration job. |
+| <a name="AZSM2062"></a>**AZSM2062** |Failed to read source file due to permission issues. | Verify that the agent has permissions to the source location. |
 | <a name="AZSM2063"></a>**AZSM2063** |Encountered I/O error while reading source file.  | It's likely that this error is temporary. Retry the migration job again. If the issue persists, create a support ticket for further assistance. |
 | <a name="AZSM2069"></a>**AZSM2069** |Failed to read target file due to permission issues.  | Verify that the agent has been granted permissions to the target location. |
 | <a name="AZSM2070"></a>**AZSM2070** |Cannot write blob because it has an active lease | This error may be caused by another agent writing to the location. Ensure no other job is running against the target. Retry or create support ticket. |
-| <a name="AZSM2071"></a>**AZSM2071** |Source file has been modified during transfer | It's likely that this error is temporary. Retry the migration job again. If the issue persists, create a support ticket for further assistance. |
+| <a name="AZSM2071"></a>**AZSM2071** |Source file was modified during transfer | It's likely that this error is temporary. Retry the migration job again. If the issue persists, create a support ticket for further assistance. |
 | <a name="AZSM2080"></a>**AZSM2080** |Copy failed due to an unknown error  | It's likely that this error is temporary. Retry the migration job again. If the issue persists, create a support ticket for further assistance. |
 
 ## Troubleshooting Storage Mover RBAC issues
@@ -82,7 +82,7 @@ During a job run, automatic RBAC assignments happen. If there are failures in as
 1.	Navigate to the appropriate resource - Key Vault, File Share or Blob Container. 
 2.	Navigate to Access Control (IAM).
 3.	Add a new role assignment: [Assign Azure roles using the Azure portal - Azure RBAC | Microsoft Learn](/azure/role-based-access-control/role-assignments-portal).
-4.	In the Add role assignment wizard, search for the appropriate role in the table below for the resource type selected in step 1. In the below example the resource would be Key Vault.
+4.	In the Add role assignment wizard, search for the appropriate role in the table below for the resource type selected in step 1. In the below example, the resource would be Key Vault.
 
 :::image type="content" source="media/troubleshooting/rbac.png" alt-text="Image showing the Key Vault resource successfully assigned roles." lightbox="media/troubleshooting/rbac.png":::
 
@@ -92,7 +92,7 @@ During a job run, automatic RBAC assignments happen. If there are failures in as
 | <a name="File Share"></a>**File Share** |Storage File Data Privileged Contributor| 
 | <a name="Blob Container"></a>**Blob Container** |Storage Blob Data Privileged Contributor | 
 
-i. Assign access should be for “Managed Identity”.<br />
+i. Assign access should be for "Managed Identity".<br />
 ii. On the right pane, select Managed Identity type as Machine – Azure Arc.<br />
 iii. Select the machine arc from the list. It is of the same name as the agent.<br />
 iv. Complete the assignment.<br />

articles/virtual-network-manager/concept-limitations.md

@@ -29,6 +29,8 @@ This article provides an overview of the current limitations when you're using [
 
 * In Azure China regions, using tags on resource groups and subscriptions in Azure Policy definitions for network group membership isn't currently supported.
 
+* An Azure Virtual Network Manager instance cannot be moved from the existing subscription to another.
+
 ## Limitations for connected groups 
 
 * A virtual network can be peered with up to 1,000 virtual networks using Azure Virtual Network Manager's hub-and-spoke connectivity configuration, meaning you can peer up to 1,000 spoke virtual networks to a hub virtual network.