--- layout: Conceptual monikers: - migrate - migrate-classic defaultMoniker: migrate versioningType: Ranged title: Support for Hyper-V assessment in Azure Migrate and Modernize - Azure Migrate | Azure Docs canonicalUrl: https://docs.azure.cn/en-us/migrate/migrate-support-matrix-hyper-v?view=migrate config_moniker_range: <=migrate-classic >=migrate breadcrumb_path: /bread/toc.json uhfHeaderId: mooncake recommendations: false ms.author: v-edwardchen ms.service: azure-migrate description: Learn about support for Hyper-V assessment with Azure Migrate - Discovery and assessment. ms.manager: abhemraj ms.topic: concept-article ms.reviewer: v-uhabiba origin.date: 2025-04-04T00:00:00.0000000Z author: rockboyfor ms.date: 2026-02-02T00:00:00.0000000Z ms.custom: engagement-fy25 locale: en-us document_id: 5b37efbf-871a-3982-d56e-3f5f5ae3e0c9 document_version_independent_id: 85dffdb4-efbc-dd76-dace-189243a37b1a updated_at: 2026-02-09T06:31:00.0000000Z original_content_git_url: https://github.com/MicrosoftDocs/mc-docs-pr/blob/live/articles/migrate/migrate-support-matrix-hyper-v.md gitcommit: https://github.com/MicrosoftDocs/mc-docs-pr/blob/718d2b54a8b525732e53e22d9d06b5b592dcb6f0/articles/migrate/migrate-support-matrix-hyper-v.md git_commit_id: 718d2b54a8b525732e53e22d9d06b5b592dcb6f0 default_moniker: migrate site_name: DocsAzureCN depot_name: Azure.mooncake-docs page_type: conceptual toc_rel: toc.json feedback_system: None feedback_product_url: '' feedback_help_link_type: '' feedback_help_link_url: '' word_count: 2802 asset_id: migrate/migrate-support-matrix-hyper-v moniker_range_name: b14779ab0f4a602c83b06d42b71b32dc monikers: - migrate - migrate-classic item_type: Content source_path: articles/migrate/migrate-support-matrix-hyper-v.md cmProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/347c5276-f041-4567-aee3-45f19a1b5e32 - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/fc3f72c2-fb6f-4cea-95ee-b444e52254ee - https://authoring-docs-microsoft.poolparty.biz/devrel/cbe4ca68-43ac-4375-aba5-5945a6394c20 spProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/802bcdcb-473d-4ef1-8382-dbeb2537d3a3 - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/f12cf087-582d-48ac-a085-0c19adf1e391 - https://authoring-docs-microsoft.poolparty.biz/devrel/ced846cc-6a3c-4c8f-9dfb-3de0e90e2742 platformId: 92e24373-12e7-c44b-87e1-365a6ec2cccc --- # Support for Hyper-V assessment in Azure Migrate and Modernize - Azure Migrate | Azure Docs This article summarizes prerequisites and support requirements when you discover and assess on-premises servers running in a Hyper-V environment for migration to Azure by using the [Azure Migrate: Discovery and assessment](migrate-services-overview) tool. If you want to migrate servers running on Hyper-V to Azure, see the [migration support matrix](migrate-support-matrix-hyper-v-migration). To set up discovery and assessment of servers running on Hyper-V, you create a project and add the Azure Migrate: Discovery and assessment tool to the project. After the tool is added, you deploy the [Azure Migrate appliance](migrate-appliance). The appliance continuously discovers on-premises servers and sends server metadata and performance data to Azure. After discovery is complete, you gather discovered servers into groups and run an assessment for a group. ## Limitations | Support | Details | | --- | --- | | Assessment limits | You can discover and assess up to 35,000 servers in a single [project](migrate-support-matrix#project). | | Project limits | You can create multiple projects in an Azure subscription. In addition to servers on Hyper-V, a project can include servers on VMware and physical servers, up to the assessment limits for each. | | Discovery | The Azure Migrate appliance can discover up to 5,000 servers running on Hyper-V. The appliance can connect to up to 300 Hyper-V hosts. | | Assessment | You can add up to 35,000 servers in a single group. You can assess up to 35,000 servers in a single assessment for a group. | [Learn more](concepts-assessment-calculation) about assessments. ## Hyper-V host requirements | Support | Details | | --- | --- | | Hyper-V host | The Hyper-V host can be standalone or deployed in a cluster. The Hyper-V host can run Windows Server 2022, Windows Server 2019, Windows Server 2016, or Windows Server 2012 R2. Server core installations of these operating systems are also supported. You can't assess servers located on Hyper-V hosts running Windows Server 2012. | | Permissions | You need Administrator permissions on the Hyper-V host. If you don't want to assign Administrator permissions, create a local or domain user account and add the user account to these groups: Remote Management Users, Hyper-V Administrators, and Performance Monitor Users. | | PowerShell remoting | [PowerShell remoting](https://learn.microsoft.com/powershell/module/microsoft.powershell.core/enable-psremoting) must be enabled on each Hyper-V host. | | Hyper-V Replica | If you use Hyper-V Replica (or you've multiple servers with the same server identifiers), and you discover both the original and replicated servers by using Azure Migrate and Modernize, the assessment generated by Azure Migrate and Modernize might not be accurate. | ## Server requirements | Support | Details | | --- | --- | | Operating system | All operating systems can be assessed for migration. | | Integration Services | [Hyper-V Integration Services](https://learn.microsoft.com/virtualization/hyper-v-on-windows/reference/integration-services) must be running on servers that you assess to capture operating system information. | | Storage | Local disk, DAS, JBOD, Storage Spaces, CSV, and SMB. These Hyper-V Host storages on which VHD/VHDX are stored are supported. IDE and SCSI virtual controllers are supported. | ## Azure Migrate appliance requirements Azure Migrate and Modernize uses the [Azure Migrate appliance](migrate-appliance) for discovery and assessment. You can deploy the appliance by using a [PowerShell script](deploy-appliance-script). For more information: - Learn about [appliance requirements](migrate-appliance#appliance---hyper-v) for Hyper-V. - Learn about URLs that the appliance needs to access in [Azure operated by 21Vianet](migrate-appliance#azure-china-21vianet-azure-china-urls) cloud. - In Azure operated by 21Vianet, you must deploy the appliance [using the script](deploy-appliance-script). ## Port access The following table summarizes port requirements for assessment. | Device | Connection | | --- | --- | | Appliance | Inbound connections on TCP port 3389 to allow remote desktop connections to the appliance. Inbound connections on port 44368 to remotely access the appliance management app by using the URL: `https://:44368` Outbound connections on ports 443 (HTTPS) to send discovery and performance metadata to Azure Migrate and Modernize. | | Hyper-V host/cluster | Inbound connection uses WinRM port 5986 (HTTPS) by default. If HTTPS prerequisites aren't configured on the target servers, the communication falls back to WinRM port 5985 (HTTP) to collect metadata and performance data for Hyper‑V servers by using a Common Information Model (CIM) session. | | Servers | Windows servers need access on port 5986 (HTTPS) or port 5985 (HTTP). Linux servers need access on port 22 (TCP) to perform software inventory and agentless dependency analysis. | ## Software inventory requirements In addition to discovering servers, Azure Migrate: Discovery and assessment can perform software inventory on servers. Software inventory provides the list of applications, roles, and features running on Windows and Linux servers that are discovered by using Azure Migrate and Modernize. It helps you to identify and plan a migration path tailored for your on-premises workloads. | Support | Details | | --- | --- | | Supported servers | You can perform software inventory on up to 5,000 servers running across Hyper-V hosts/clusters added to each Azure Migrate appliance. | | Operating systems | All Windows and Linux versions with [Hyper-V integration services](https://learn.microsoft.com/virtualization/hyper-v-on-windows/reference/integration-services) enabled. | | Server requirements | Windows servers must have PowerShell remoting enabled and PowerShell version 2.0 or later installed. WMI must be enabled and available on Windows servers to gather the details of the roles and features installed on the servers. Linux servers must have Secure Shell (SSH) connectivity enabled and ensure that the following commands can be executed on the Linux servers to pull the application data: list, tail, awk, grep, locate, head, sed, ps, print, sort, uniq. Based on OS type and the type of package manager being used, here are some more commands: rpm/snap/dpkg, yum/apt-cache, mssql-server. | | Server access | You can add multiple domains and nondomain (Windows/Linux) credentials in the appliance configuration manager for software inventory. You must have a guest user account for Windows servers and a standard user account (non-sudo access) for all Linux servers. | | Port access | Windows servers need access on port 5986 (HTTPS) or port 5985 (HTTP). Linux servers need access on port 22 (TCP).If you use domain credentials, the Azure Migrate appliance must be able to connect to the following TCP and UDP ports: TCP 135 - RPC EndpointTCP 389 - LDAPTCP 636 - LDAP SSLTCP 445 - SMBTCP/UDP 88 - Kerberos authenticationTCP/UDP 464 - Kerberos change operations | | Discovery | Software inventory is performed by directly connecting to the servers by using the server credentials added on the appliance. The appliance gathers the information about the software inventory from Windows servers by using PowerShell remoting and from Linux servers by using the SSH connection. Software inventory is agentless. No agent is installed on the servers. | ## SQL Server instance and database discovery requirements [Software inventory](how-to-discover-applications) identifies SQL Server instances. The appliance uses this information and attempts to connect to respective SQL Server instances through the Windows authentication or SQL Server authentication credentials that are provided in the appliance configuration manager. The appliance can connect to only those SQL Server instances to which it has network line of sight. Software inventory by itself might not need network line of sight. After the appliance is connected, it gathers configuration and performance data for SQL Server instances and databases. SQL Server configuration data is updated once every 24 hours. Performance data is captured every 30 seconds. | Support | Details | | --- | --- | | Supported servers | Supported only for servers running SQL Server in your VMware, Microsoft Hyper-V, and physical/bare-metal environments and infrastructure as a service (IaaS) servers of other public clouds, such as Azure Web Services and Google Cloud Platform. You can discover up to 750 SQL Server instances or 15,000 SQL databases, whichever is less, from a single appliance. We recommend that you ensure that an appliance is scoped to discover less than 600 servers running SQL to avoid scaling issues. | | Windows servers | Windows Server 2008 and later are supported. | | Linux servers | Currently not supported. | | Authentication mechanism | Both Windows and SQL Server authentication are supported. You can provide credentials of both authentication types in the appliance configuration manager. | | SQL Server access | To discover SQL Server instances and databases, the Windows/ Domain account, or SQL Server account [requires these low privilege read permissions](migrate-support-matrix-vmware) for each SQL Server instance. You can use the [low-privilege account provisioning utility](least-privilege-credentials) to create custom accounts or use any existing account that is a member of the sysadmin server role for simplicity. | | SQL Server versions | SQL Server 2008 and later are supported. | | SQL Server editions | Enterprise, Standard, Developer, and Express editions are supported. | | Supported SQL configuration | Discovery of standalone, highly available, and disaster-protected SQL deployments is supported. Discovery of high-availability and disaster recovery SQL deployments powered by Always On failover cluster instances and Always On availability groups is also supported. | | Supported SQL services | Only SQL Server Database Engine is supported. Discovery of SQL Server Reporting Services, SQL Server Integration Services, and SQL Server Analysis Services isn't supported. | Note By default, Azure Migrate and Modernize uses the most secure way of connecting to SQL instances. That is, Azure Migrate and Modernize encrypts communication between the Azure Migrate appliance and the source SQL Server instances by setting the `TrustServerCertificate` property to `true`. Also, the transport layer uses Secure Socket Layer to encrypt the channel and bypass the certificate chain to validate trust. For this reason, the appliance server must be set up to trust the certificate's root authority. However, you can modify the connection settings by selecting **Edit SQL Server connection properties** on the appliance. [Learn more](https://learn.microsoft.com/sql/database-engine/configure-windows/enable-encrypted-connections-to-the-database-engine) to understand what to choose. ### Configure the custom login for SQL Server discovery Use the following sample scripts to create a login and provision it with the necessary permissions. #### Windows authentication ```sql -- Create a login to run the assessment use master; DECLARE @SID NVARCHAR(MAX) = N''; CREATE LOGIN [MYDOMAIN\MYACCOUNT] FROM WINDOWS; SELECT @SID = N'0x'+CONVERT(NVARCHAR, sid, 2) FROM sys.syslogins where name = 'MYDOMAIN\MYACCOUNT' IF (ISNULL(@SID,'') != '') PRINT N'Created login [MYDOMAIN\MYACCOUNT] with SID = ' + @SID ELSE PRINT N'Login creation failed' GO -- Create a user in every database other than tempdb, model, and secondary AG databases (with connection_type = ALL) and provide minimal read-only permissions. USE master; EXECUTE sp_MSforeachdb ' USE [?]; IF (''?'' NOT IN (''tempdb'',''model'')) BEGIN DECLARE @is_secondary_replica BIT = 0; IF CAST(PARSENAME(CAST(SERVERPROPERTY(''ProductVersion'') AS VARCHAR), 4) AS INT) >= 11 BEGIN DECLARE @innersql NVARCHAR(MAX); SET @innersql = N'' SELECT @is_secondary_replica = IIF( EXISTS ( SELECT 1 FROM sys.availability_replicas a INNER JOIN sys.dm_hadr_database_replica_states b ON a.replica_id = b.replica_id WHERE b.is_local = 1 AND b.is_primary_replica = 0 AND a.secondary_role_allow_connections = 2 AND b.database_id = DB_ID() ), 1, 0 ); ''; EXEC sp_executesql @innersql, N''@is_secondary_replica BIT OUTPUT'', @is_secondary_replica OUTPUT; END IF (@is_secondary_replica = 0) BEGIN CREATE USER [MYDOMAIN\MYACCOUNT] FOR LOGIN [MYDOMAIN\MYACCOUNT]; GRANT SELECT ON sys.sql_expression_dependencies TO [MYDOMAIN\MYACCOUNT]; GRANT VIEW DATABASE STATE TO [MYDOMAIN\MYACCOUNT]; END END' GO -- Provide server level read-only permissions use master; GRANT SELECT ON sys.sql_expression_dependencies TO [MYDOMAIN\MYACCOUNT]; GRANT EXECUTE ON OBJECT::sys.xp_regenumkeys TO [MYDOMAIN\MYACCOUNT]; GRANT EXECUTE ON OBJECT::sys.xp_instance_regread TO [MYDOMAIN\MYACCOUNT]; GRANT VIEW DATABASE STATE TO [MYDOMAIN\MYACCOUNT]; GRANT VIEW SERVER STATE TO [MYDOMAIN\MYACCOUNT]; GRANT VIEW ANY DEFINITION TO [MYDOMAIN\MYACCOUNT]; GO -- Provide msdb specific permissions use msdb; GRANT EXECUTE ON [msdb].[dbo].[agent_datetime] TO [MYDOMAIN\MYACCOUNT]; GRANT SELECT ON [msdb].[dbo].[sysjobsteps] TO [MYDOMAIN\MYACCOUNT]; GRANT SELECT ON [msdb].[dbo].[syssubsystems] TO [MYDOMAIN\MYACCOUNT]; GRANT SELECT ON [msdb].[dbo].[sysjobhistory] TO [MYDOMAIN\MYACCOUNT]; GRANT SELECT ON [msdb].[dbo].[syscategories] TO [MYDOMAIN\MYACCOUNT]; GRANT SELECT ON [msdb].[dbo].[sysjobs] TO [MYDOMAIN\MYACCOUNT]; GRANT SELECT ON [msdb].[dbo].[sysmaintplan_plans] TO [MYDOMAIN\MYACCOUNT]; GRANT SELECT ON [msdb].[dbo].[syscollector_collection_sets] TO [MYDOMAIN\MYACCOUNT]; GRANT SELECT ON [msdb].[dbo].[sysmail_profile] TO [MYDOMAIN\MYACCOUNT]; GRANT SELECT ON [msdb].[dbo].[sysmail_profileaccount] TO [MYDOMAIN\MYACCOUNT]; GRANT SELECT ON [msdb].[dbo].[sysmail_account] TO [MYDOMAIN\MYACCOUNT]; GO -- Clean up --use master; -- EXECUTE sp_MSforeachdb 'USE [?]; DROP USER [MYDOMAIN\MYACCOUNT]' -- DROP LOGIN [MYDOMAIN\MYACCOUNT]; --GO ``` #### SQL Server authentication ```sql --- Create a login to run the assessment use master; -- NOTE: SQL instances that host replicas of Always On availability groups must use the same SID for the SQL login. -- After the account is created in one of the members, copy the SID output from the script and include this value -- when executing against the remaining replicas. -- When the SID needs to be specified, add the value to the @SID variable definition below. DECLARE @SID NVARCHAR(MAX) = N''; IF (@SID = N'') BEGIN CREATE LOGIN [evaluator] WITH PASSWORD = '' END ELSE BEGIN DECLARE @SQLString NVARCHAR(500) = 'CREATE LOGIN [evaluator] WITH PASSWORD = '''' , SID = ' + @SID EXEC SP_EXECUTESQL @SQLString END SELECT @SID = N'0x'+CONVERT(NVARCHAR(100), sid, 2) FROM sys.syslogins where name = 'evaluator' IF (ISNULL(@SID,'') != '') PRINT N'Created login [evaluator] with SID = '''+ @SID +'''. If this instance hosts any Always On Availability Group replica, use this SID value when executing the script against the instances hosting the other replicas' ELSE PRINT N'Login creation failed' GO -- Create a user in every database other than tempdb, model, and secondary AG databases (with connection_type = ALL) and provide minimal read-only permissions. USE master; EXECUTE sp_MSforeachdb ' USE [?]; IF (''?'' NOT IN (''tempdb'',''model'')) BEGIN DECLARE @is_secondary_replica BIT = 0; IF CAST(PARSENAME(CAST(SERVERPROPERTY(''ProductVersion'') AS VARCHAR), 4) AS INT) >= 11 BEGIN DECLARE @innersql NVARCHAR(MAX); SET @innersql = N'' SELECT @is_secondary_replica = IIF( EXISTS ( SELECT 1 FROM sys.availability_replicas a INNER JOIN sys.dm_hadr_database_replica_states b ON a.replica_id = b.replica_id WHERE b.is_local = 1 AND b.is_primary_replica = 0 AND a.secondary_role_allow_connections = 2 AND b.database_id = DB_ID() ), 1, 0 ); ''; EXEC sp_executesql @innersql, N''@is_secondary_replica BIT OUTPUT'', @is_secondary_replica OUTPUT; END IF (@is_secondary_replica = 0) BEGIN CREATE USER [evaluator] FOR LOGIN [evaluator]; GRANT SELECT ON sys.sql_expression_dependencies TO [evaluator]; GRANT VIEW DATABASE STATE TO [evaluator]; END END' GO -- Provide server level read-only permissions USE master; GRANT SELECT ON sys.sql_expression_dependencies TO [evaluator]; GRANT EXECUTE ON OBJECT::sys.xp_regenumkeys TO [evaluator]; GRANT EXECUTE ON OBJECT::sys.xp_instance_regread TO [evaluator]; GRANT VIEW DATABASE STATE TO [evaluator]; GRANT VIEW SERVER STATE TO [evaluator]; GRANT VIEW ANY DEFINITION TO [evaluator]; GO -- Provide msdb specific permissions USE msdb; GRANT EXECUTE ON [msdb].[dbo].[agent_datetime] TO [evaluator]; GRANT SELECT ON [msdb].[dbo].[sysjobsteps] TO [evaluator]; GRANT SELECT ON [msdb].[dbo].[syssubsystems] TO [evaluator]; GRANT SELECT ON [msdb].[dbo].[sysjobhistory] TO [evaluator]; GRANT SELECT ON [msdb].[dbo].[syscategories] TO [evaluator]; GRANT SELECT ON [msdb].[dbo].[sysjobs] TO [evaluator]; GRANT SELECT ON [msdb].[dbo].[sysmaintplan_plans] TO [evaluator]; GRANT SELECT ON [msdb].[dbo].[syscollector_collection_sets] TO [evaluator]; GRANT SELECT ON [msdb].[dbo].[sysmail_profile] TO [evaluator]; GRANT SELECT ON [msdb].[dbo].[sysmail_profileaccount] TO [evaluator]; GRANT SELECT ON [msdb].[dbo].[sysmail_account] TO [evaluator]; GO -- Clean up --use master; -- EXECUTE sp_MSforeachdb 'USE [?]; BEGIN TRY DROP USER [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH;' -- BEGIN TRY DROP LOGIN [evaluator] END TRY BEGIN CATCH PRINT ERROR_MESSAGE() END CATCH; --GO ``` ## Web apps discovery requirements [Software inventory](how-to-discover-applications) identifies the web server role that exists on discovered servers. If a server is found to have a web server installed, Azure Migrate and Modernize discovers web apps on the server. You can add both domain and nondomain credentials on the appliance. Ensure that the account used has local admin privileges on source servers. Azure Migrate and Modernize automatically maps credentials to the respective servers, so you don't have to map them manually. These credentials are never sent to Azure and remain on the appliance running in the source environment. After the appliance is connected, it gathers configuration data for ASP.NET web apps (IIS web server) and Java web apps (Tomcat servers). Web apps configuration data is updated once every 24 hours. | Support | ASP.NET web apps | Java web apps | | --- | --- | --- | | Stack | VMware, Hyper-V, and physical servers. | VMware, Hyper-V, and physical servers. | | Windows servers | Windows Server 2008 R2 and later are supported. | Not supported. | | Linux servers | Not supported | Servers that meet the [requirements](/en-us/migrate/migrate-support-matrix-hyper-v?view=migrate#hyper-v-host-requirements) | | Web server versions | IIS 7.5 and later | Tomcat 8 or later | | Required privileges | The least privileged user should be a part of the two user groups 1. Remote Management Users 2. IIS\_IUSRS. The users must have read permissions to the following locations: C:\Windows\system32\inetsrv\config, C:\Windows\system32\inetsrv\config\applicationHost.config and C:\Windows\system32\inetsrv\config\redirection.config. | **Read (r)** and **Execute (x)** permissions recursively on all CATALINA\_HOME directories. | Note Data is always encrypted at rest and during transit. ## Dependency analysis requirements (agentless) [Dependency analysis](concepts-dependency-visualization) helps you analyze the dependencies between the discovered servers. You can easily visualize dependencies with a map view in an Azure Migrate project. You can use dependencies to group related servers for migration to Azure. The following table summarizes the requirements for setting up agentless dependency analysis. | Support | Details | | --- | --- | | Supported servers | You can enable agentless dependency analysis on up to 1,000 servers (across multiple Hyper-V hosts/clusters) discovered per appliance. | | Operating systems | All Windows and Linux versions with [Hyper-V integration services](https://learn.microsoft.com/windows-server/virtualization/hyper-v/supported-windows-guest-operating-systems-for-hyper-v-on-windows) enabled. | | Server requirements | Windows servers must have PowerShell remoting enabled and PowerShell version 2.0 or later installed. Linux servers must have SSH connectivity enabled and ensure that the following commands can be executed on the Linux servers: touch, chmod, cat, ps, grep, echo, sha256sum, awk, netstat, ls, sudo, dpkg, rpm, sed, getcap, which, date. | | Windows server access | A user account (local or domain) with administrator permissions on servers | | Linux server access | A sudo user account with permissions to execute ls and netstat commands. If you're providing a sudo user account, ensure that you enable **NOPASSWD** for the account to run the required commands without prompting for a password every time a sudo command is invoked. | | Port access | Windows servers need access on port 5986 (HTTPS) or port 5985 (HTTP). Linux servers need access on port 22 (TCP). | | Discovery method | Agentless dependency analysis is performed by directly connecting to the servers by using the server credentials added on the appliance. The appliance gathers the dependency information from Windows servers by using PowerShell remoting and from Linux servers by using the SSH connection. No agent is installed on the servers to pull dependency data. |