VM Protection group and Recovery plan Creation Fails with "Unexpected exception during prepare phase" or "ActAsToken" Errors.

Products

VMware Live Recovery VMware vSphere ESXi

Issue/Introduction

Symptoms

Unable to protect virtual machines or configure new protection groups in Site Recovery Manager (SRM).
On the SRM DR page UI this error is displayed: Internal error: Received unexpected exception during prepare phase.
SRM site pairing may appear connected, but storage-related operations fail.
Configured Protection groups in SRM display an error - "There are configuration issues"
VM protection status in the Protection Group shows - "Not configured"
The following error is displayed in the the VMware Live Site Recovery DR page UI ( URL: https://SRM-IP or VR-IP/dr)

SRM Server cannot connect to Unknown Service at https:####:443/sms/sdk. Access to perform the operation was denied.

The /var/log/vmware/srm/vmware-dr.log file of the VLR appliance contains these entries:

fault: (vmodl.fault.SecurityError)"Received SOAP response fault from [<SSL(<io_obj ...>), /pbm/sdk>]: fetchResourceType --> Error while fetching ActAsToken"N2Dr5Fault22PbmConnectionDownFault9ExceptionE(Fault cause: dr.fault.PbmConnectionDownFault

OR

2026-07-14T15:34:19.229Z warning vmware-dr[01439] [SRM@6876 sub=Default connID=pbm-40d7] Error while calling STS
--> N9SsoClient12SsoExceptionE Unexpected SOAP fault: ns0:RequestFailed; request failed.
2026-07-14T15:34:19.229Z error vmware-dr[01439] [SRM@6876 sub=LocalSite.LocalPbmServer connID=pbm-40d7] Unable to acquire a delegated SSO token for user='sps-xxxxxxxx-xxxx-xxxx-xxxx- xxxxxxxxxxxx':
--> (dr.fault.ConnectionDownFault) OR

2026-09-18T11:02:22.030Z error vmware-dr[140767] [SRMe6876 sub=Replication opID=...] Operation failed during prepare phase
2026-09-18T11:02:22.030Z error vmware-dr[140767] [SRM06876 sub=Replication opID=...] Received unexpected exception during prepare phase:-- > (dr.multiSiteOperation.fault.CohortPrepareFault)
fault = (dr.fault.InternalError) {
reason = "Unexpected exception from VM protection prepare phase"
msg = "Internal error: Unexpected exception from VM protection prepare phase."

In the sps.log file of the vCenter Server contains these entries:

"Failed to acquire delegate HoK token""com.vmware.vim.sso.client.exception.InvalidTokenRequestException: Request is invalid: ns0:InvalidRequest: Cannot continue delegation chain""VpxdException: Error while fetching ActAsToken"

Environment

vCenter Server 9.0,9.1
VMware Site Recovery Manager 9.0.2
VMware vSphere Replication 9.0.2

Cause

This issue occurs due to an unsupported interoperability configuration between SRM 9.0.2 and vCenter 9.0 or 9.1.

vCenter 9.0 Interoperability: The version mismatch causes a breakdown in the SAML token delegation chain. The vCenter Single Sign-On (SSO) service rejects delegation requests from the SRM solution user, preventing the acquisition of the ActAsToken. Without this token, SRM cannot authenticate with the vCenter Storage Profile Service (SPS/PBM).
vCenter 9.1 Interoperability: With the release of vCenter 9.1, standalone Site Recovery Manager (SRM) and vSphere Replication (VR) appliances are deprecated. Environments running vCenter 9.1 must transition to the new unified VCF Protection and Recovery appliance architecture. Running the legacy 9.0.2 standalone appliances triggers internal prepare phase exceptions.

Resolution

To resolve this issue, the disaster recovery environment must be brought into a supported interoperability state. Always consult the VMware Interoperability Matrix before beginning upgrades.

For vCenter 9.0 Environments:

Upgrade: Upgrade both Site Recovery Manager and vSphere Replication appliances to version 9.0.5 on both the protected and recovery sites. (It is highly recommended to follow the convergence path to the VMware Live Recovery 9.0.5 appliance model).
Reconfigure the Appliance: Once the upgrade is complete, re-establish the solution user registration:
- Log in to the Appliance Management Interface (AMI) at https://<appliance-address>:5480.
- Navigate to the Summary page.
- Click Reconfigure and complete the wizard to re-establish the trust relationship and delegation path within the vCenter SSO domain.
Verify: Ensure the vmware-sps service is running on the vCenter Server and that the SRM site pair is fully connected.

For vCenter 9.1 Environments:

Deploy or upgrade to the unified VCF Protection and Recovery 9.1 (or VMware Live Recovery 9.0.4+) appliance. This aligns the environment with vCenter 9.1's mandatory architectural requirements.
Refer to the documentation on Steps to Converge to VMware Live Recovery Appliance for convergence instructions.