---
title: "Azure VM Hibernation Failures Caused by Azure VM Agent Communication Issues"
slug: "azure-vm-hibernation-failures-caused-by-azure-vm-agent-communication-issues"
updated: 2026-07-15T09:43:55Z
published: 2026-07-15T09:43:55Z
canonical: "docs.workspot.com/azure-vm-hibernation-failures-caused-by-azure-vm-agent-communication-issues"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.workspot.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure VM Hibernation Failures Caused by Azure VM Agent Communication Issues

# Overview

Use this article to troubleshoot Azure VMs that fail to hibernate or pause because the Azure VM Agent cannot reach required Azure platform endpoints.

Typical indicators include a VM that remains Running, Azure VM Agent status **Not Ready**, or **AzureHibernateExtension** showing **Unavailable** or failed.

# Symptoms

- VM does not hibernate or pause successfully.
- VM remains in **Running** state.
- Workspot Watch reports *Error happened while pausing VM*.
- Azure VM Agent shows **Not Ready**.
- **AzureHibernateExtension** shows **Unavailable** or failed.

**Impact:** Affected VMs may continue consuming compute resources because they remain running.

# Root Cause

The Azure VM Agent must communicate with Azure platform endpoints to report hibernation extension health.

Microsoft diagnostics found HTTP 502 responses between the VM Agent and **168.63.129.16**. When extension health cannot be reported, Azure blocks hibernation.

**Example error:** **OperationNotAllowed / AzureHibernateExtension in failed state**

If the VMs previously hibernated successfully, this is usually not a hibernation configuration issue. HTTP 502 commonly indicates proxy, secure web gateway, traffic steering, or inspection interference. Microsoft also observed Netskope, Zscaler, and CrowdStrike Falcon on the affected VM, with no Windows system proxy configured.

# Affected Azure Endpoints

Allow the VM to reach these Azure platform endpoints directly. Do not route this traffic through proxy, SSL inspection, secure web gateway, or traffic filtering.

| **Endpoint** | **Purpose** | **Required Ports / Requirement** |
| --- | --- | --- |
| 168.63.129.16 | Azure WireServer used by the Azure VM Agent for platform communication | TCP 80 and TCP 32526 must be reachable directly |
| 169.254.169.254 | Azure Instance Metadata Service (IMDS) | TCP 80 must be queried directly while bypassing any proxy |

# How to Identify the Issue

Use these checks to confirm endpoint connectivity and extension health.

## 1. Check the Azure VM Agent status

- Open the affected VM in Azure Portal.
- Go to Overview > Properties.
- Confirm the VM Agent status. **Not Ready** indicates communication issues.

**Screenshot:** Azure Portal VM **Overview > Properties** showing VM Agent status.

![](https://cdn.us.document360.io/ad9153e1-c8de-4f56-94f2-b717a1fc3a68/Images/Documentation/image(119).png)

## 2. Check the AzureHibernateExtension status

- Open the affected VM in Azure Portal.
- Go to Extensions + applications.
- Confirm **AzureHibernateExtension** status. **Unavailable** or failed can block hibernation.

**Figure:** Example Azure Portal view showing **AzureHibernateExtension** failed or unavailable. ![](https://cdn.us.document360.io/ad9153e1-c8de-4f56-94f2-b717a1fc3a68/Images/Documentation/image(120).png)

## 3. Test connectivity from the affected VM

Run:

```plaintext
Test-NetConnection -ComputerName 168.63.129.16 -Port 80
Test-NetConnection -ComputerName 168.63.129.16 -Port 32526
```

If **TcpTestSucceeded** is **False**, review proxy, security, or inspection settings. Also confirm **169.254.169.254** bypasses proxy inspection.

# Resolution

Configure proxy, secure web gateway, endpoint security, or inspection tools to bypass Azure platform endpoint traffic.

## Recommended remediation steps

1. Identify proxy, secure web gateway, endpoint security, or inspection tools on affected VMs.

2. Add bypass rules for:

- 168.63.129.16 on TCP ports 80 and 32526
- 169.254.169.254 on TCP port 80

3. Test the bypass on one affected VM.

4. Validate:

- **168.63.129.16** connectivity on TCP **80** and **32526**.
- **169.254.169.254** bypasses proxy or inspection.
- VM hibernation succeeds.

5. Roll out to remaining affected VMs.

6. If VM Agent still shows **Not Ready**, reboot during an approved maintenance window.

# Monitoring for Pause Failures

Enable Workspot Watch email notifications to detect future pause failures.

1. Log in to Workspot Watch.
2. Navigate to Manage > Email Notifications.
3. Set **Desktop – Pause Failures** notification frequency as needed.
4. Add the appropriate email recipients.

**Screenshot:** Workspot Watch **Manage > Email Notifications** showing **Desktop – Pause Failures**. ![](https://cdn.us.document360.io/ad9153e1-c8de-4f56-94f2-b717a1fc3a68/Images/Documentation/image(118).png)

# Microsoft Reference Documentation

- What is IP address 168.63.129.16? https://learn.microsoft.com/en-us/azure/virtual-network/what-is-ip-address-168-63-129-16
- Azure Instance Metadata Service (IMDS) – Proxies section: https://learn.microsoft.com/en-us/azure/virtual-machines/instance-metadata-service
- Hibernate-Resume Troubleshooting – Common Error Codes: https://learn.microsoft.com/en-us/azure/virtual-machines/hibernate-resume-troubleshooting#common-error-codes

# Summary

- Azure hibernation requires healthy Azure VM Agent communication.
- Microsoft found HTTP 502 responses between the VM Agent and **168.63.129.16**.
- Allow direct access to **168.63.129.16** on TCP **80** and **32526**.
- Ensure **169.254.169.254** bypasses proxy and inspection.
- Proxy, secure web gateway, or inspection tools may require bypass rules.