Upgrade from Redis

Updating the solution → Upgrading from an older build → Upgrade from Redis

This page is for administrators upgrading a deployment last installed with a build before 1846, which kept its runtime state in Azure Cache for Redis. It explains what changes, the one-off effects on imports, and how to remove the old cache. If your deployment is on 1846 or later, you don't need it.

Upgrading from a release that used Redis

From Stable build 1846, the solution no longer uses Azure Cache for Redis / Azure Managed Redis. Runtime state lives in the solution storage account, in the AnalyticsState Azure Table. If you are upgrading from a release that used Redis, its contents are not migrated: plan for the following one-off effects.

What changes immediately

• The installer no longer creates a cache, access policy, cache firewall/private endpoint or privatelink.redis.* DNS zone, nor grants Redis Cache Contributor. The retirement introduced schema 3.0.0 from 2.6.0. Older files load; RedisName and NetworkConfig.CustomEndpointNames.Redis are ignored/dropped on re-save. The saved copy uses the saving installer's schema: 3.0.0 in 1850, 3.3.0 in 1852, 3.4.0 in 1854, 3.5.0 in 1856 and 1857, and 3.6.0 from 1859, whose secrets installers from 1857 and earlier can't read (details).
• The installer UI no longer asks for a cache name or cache private-endpoint name. The web app and WebJobs no longer read a Redis connection string. Installer upgrades remove that connection string from App Service because the full connection-string collection is rewritten.
• The replacement state table is created automatically in the existing storage account named by the Storage connection string. If shared-key storage access is disabled, the runtime service principal must have Storage Table Data Contributor on the storage account. The installer already grants it; Storage Blob Data Contributor alone is not enough for tables.
• Private deployments use the storage account's table private endpoint and privatelink.table.core.windows.net DNS zone, which the installer has created since Stable build 1716. If your private deployment was last installed with an earlier build, running the current installer for this upgrade adds them. No other new resource, role or network rule is needed.

One-off import effects

• Teams deep analytics: re-authorise every Team once in Administration → Teams permissions. The old per-Team delegated tokens were stored in Redis. Until re-authorised, those Teams' channel messages are not read; other Teams data continues importing.
• Interval-gated imports: the first cycle runs every gated import because the previous last-run stamps are gone. This includes user metadata, Teams metadata, Copilot usage reports, interaction history, Copilot Studio credits, Azure costs and usage reports.
• Graph user import: the first run performs a full read of all users because there is no delta checkpoint. This can take a few hours on a very large tenant; users are updated, not duplicated.
• Usage reports and Teams channels: each usage report downloads its full configured window once, and Teams channels are read in full once after re-authorisation.
• Sent email import: if enabled, each mailbox's Sent Items folder is read once more. Messages already imported are skipped, but the first pass is much slower than a normal delta run on large tenants.

Clean up the old cache after the upgrade

The installer logs a warning for every Microsoft.Cache/redis or Microsoft.Cache/redisEnterprise resource it finds in the solution resource group, explaining that it is no longer used and can be deleted to stop paying for it. It never deletes resources automatically.

After confirming nothing else uses the cache:

1. Delete the Azure Cache for Redis / Azure Managed Redis resource.
2. On private deployments, delete the cache private endpoint and the privatelink.redis.azure.net / privatelink.redis.cache.windows.net private DNS zone if nothing else uses them.
3. Optionally remove the runtime service principal's now-unused Redis Cache Contributor role assignment from the resource group.

Manual or binaries-only deployments

For deployments not upgraded by the installer, delete the Redis connection string from the App Service and keep the Storage connection string. If the storage account has shared-key access disabled, grant the runtime service principal Storage Table Data Contributor on the storage account before starting the new WebJobs.

On private deployments, also make sure the storage account has a table private endpoint (the installer names it pe-<storage account>-table) linked to the privatelink.table.core.windows.net private DNS zone, before starting the new WebJobs. Installers before Stable build 1716 did not create them. A private deployment last installed with an older build, whose storage account blocks public network access, and upgraded with the binaries alone cannot reach its runtime state. (If the storage account still allows public network access, the state table is reached over its public endpoint and keeps working; creating the private endpoint is still recommended.) In the blocked case every state operation fails with 403 AuthorizationFailure. The Graph user import is deferred on every cycle. Because it runs first, the Microsoft Graph imports after it (usage reports, Copilot usage reports, Teams, sent email, Copilot interaction history) are skipped too. The WebJob logs Got exception on GetGraphTeamsAndUserData: User delta token store is unavailable and this process has no last committed checkpoint. Deferring user metadata/licence import rather than treating the outage as a cache miss and starting a full tenant crawl. Teams deep analytics can't be authorised either. At the start of every audit-import cycle the WebJob also logs Storage firewall/network rules rejected the Table checkpoint request (HTTP 403 AuthorizationFailure), which looks like a public-networking problem but here means the endpoint is missing. Run the current installer, or create the endpoint and DNS link by hand.

---

Return to Updating the solution · All topics in this guide

Previous: Upgrade to Build 1852 · Next: URLs Full URL Shrink Upgrade