How to Configure Hyper-V Replica Authorization Entries in Windows 11 Using PowerShell

Hyper-V Replica provides asynchronous, storage-agnostic virtual machine replication across physical virtualization hosts, establishing resilient disaster recovery capabilities without requiring expensive shared storage area networks (SANs). In enterprise environments and multi-tenant virtualization clusters, configuring a destination host as a Hyper-V Replica server requires robust access control. Rather than allowing arbitrary remote hosts to push replication data indiscriminately, administrators configure Replica Authorization Entries. In Windows 11 and Windows Server Hyper-V environments, the *-VMReplicationAuthorizationEntry cmdlets in PowerShell allow administrators to enforce authentication boundaries, designate dedicated storage paths per tenant, and manage trust groups.

Understanding Hyper-V Replica Authorization Architecture

When a destination host is configured to receive replicated virtual machine blocks, its replication listener evaluates incoming connections against an authorization table:

• Allowed Primary Server: Defines the Fully Qualified Domain Name (FQDN) or wildcard pattern (e.g., *.contoso.com) representing the primary Hyper-V host permitted to replicate virtual machines.
• Replica Storage Location: Designates the specific local or network-attached directory where replica VHDX files, configuration XML/VMCX files, and recovery point logs for that specific primary host will be stored.
• Trust Group: An administrative grouping tag that prevents cross-tenant replication pollution. Replicating virtual machines must match the trust group assigned to their authorization entry to proceed.
• Authentication Handshake: Connections are authenticated either via Kerberos (HTTP port 80 or 8080) for domain-joined hosts or via Mutual Certificate Authentication (X.509 certificates over HTTPS port 443).

Enabling the Hyper-V Replica Server

Before adding authorization entries, you must configure the destination Windows 11 host to function as a replication server using the Set-VMReplicationServer cmdlet. Open an elevated PowerShell session (Run as Administrator):

# Enable host as Replica server using Kerberos authentication
Set-VMReplicationServer -ReplicationEnabled $true `
  -AllowedAuthenticationType Kerberos `
  -KerberosPort 80 `
  -ReplicationAllowedFromAnyServer $false

Setting -ReplicationAllowedFromAnyServer $false enforces strict authorization checks, requiring explicit authorization table entries before any replication traffic is accepted.

Inspecting Existing Replica Authorization Entries

To inspect the current authorization table on the replica host, execute:

Get-VMReplicationAuthorizationEntry

To view comprehensive properties for a specific primary server entry:

Get-VMReplicationAuthorizationEntry -AllowedPrimaryServer "hv-primary-01.contoso.com" | Format-List AllowedPrimaryServer, ReplicaStorageLocation, TrustGroup

A typical active configuration output displays:

AllowedPrimaryServer   : hv-primary-01.contoso.com
ReplicaStorageLocation : D:\Hyper-V\Replicas\TenantA\
TrustGroup             : ProductionClusterAlpha

Creating New Authorization Entries with New-VMReplicationAuthorizationEntry

To authorize an inbound primary virtualization server and assign it a dedicated storage path, use the New-VMReplicationAuthorizationEntry cmdlet.

Example 1: Authorizing a Dedicated Primary Server FQDN

The following command grants replication rights to a specific primary host, directing its virtual disks into a dedicated storage tier:

New-VMReplicationAuthorizationEntry `
  -AllowedPrimaryServer "hv-primary-01.contoso.com" `
  -ReplicaStorageLocation "D:\Hyper-V\Replicas\HV01" `
  -TrustGroup "PrimaryDatacenter"

Example 2: Authorizing Wildcard Domain Patterns

In environments managing large host farms across branch offices, administrators can authorize an entire Active Directory domain or subdomain using wildcard syntax:

New-VMReplicationAuthorizationEntry `
  -AllowedPrimaryServer "*.branch.contoso.com" `
  -ReplicaStorageLocation "E:\ReplicaStorage\BranchVMs" `
  -TrustGroup "BranchOffices"

Modifying Existing Authorization Entries with Set-VMReplicationAuthorizationEntry

If storage volumes are migrated or trust boundaries change, update authorization entries using Set-VMReplicationAuthorizationEntry:

# Update storage path and trust group for authorized host
Set-VMReplicationAuthorizationEntry `
  -AllowedPrimaryServer "hv-primary-01.contoso.com" `
  -ReplicaStorageLocation "F:\HighSpeedStorage\Replicas" `
  -TrustGroup "Tier1Production"

Configuring Windows Defender Firewall Rules for Replication Traffic

For incoming replication handshakes to reach the Hyper-V replica listener, the appropriate Windows Defender Firewall rules must be enabled on the destination host:

# For Kerberos HTTP replication traffic
Enable-NetFirewallRule -DisplayName "Hyper-V Replica HTTP Listener (TCP-In)"

# For Certificate HTTPS replication traffic
Enable-NetFirewallRule -DisplayName "Hyper-V Replica HTTPS Listener (TCP-In)"

Removing Obsolete Authorization Entries

When a primary server is decommissioned or replication relationships are retired, remove its access privileges using Remove-VMReplicationAuthorizationEntry:

Remove-VMReplicationAuthorizationEntry `
  -AllowedPrimaryServer "hv-primary-01.contoso.com" `
  -Confirm:$false

Validating Inbound Replication Handshakes

To verify that an authorized primary server can successfully establish replication, initiate replication from the primary host in PowerShell:

# Execute on the primary host
Enable-VMReplication -VMName "AppServer-01" `
  -ReplicaServerName "hv-replica-01.contoso.com" `
  -ReplicaServerPort 80 `
  -AuthenticationType Kerberos

Start-VMInitialReplication -VMName "AppServer-01"

On the replica host, execute Get-VMReplication to verify that the virtual machine registers in a normal replicating state within the authorized storage path.

By using PowerShell’s *-VMReplicationAuthorizationEntry cmdlets, virtualization administrators enforce granular multi-tenant access controls, segregate disaster recovery storage volumes, and maintain resilient business continuity across Hyper-V environments.