PostgreSQL version upgrade blocked

Julia 60 Reputation points
2026-07-04T05:52:27.4766667+00:00

I'm trying to upgrade Azure Database for PostgreSQL Flexible Server (locelle-stg-cac-db) from version 11 to 16. The upgrade fails because a role azure_pg_failover_slots_validator has the replication attribute which cannot be removed without superuser access. How can Azure support remove this attribute so the upgrade can proceed?

Azure Database for PostgreSQL
Answer accepted by question author
Pilladi Padma Sai Manisha 11,715 Reputation points Microsoft External Staff Moderator
2026-07-21T20:25:12.2166667+00:00

Hi @Julia
To help us investigate this further, could you please run the following query and share the output?

Additionally, we noticed that the server parameter azure.accepted_password_auth_method is currently set to MD5.

Could you please update this parameter to SCRAM-SHA-256, allow the change to take effect (restart if prompted), and then retry the major version upgrade?

Once completed, please let us know:

  • The output of the SELECT * FROM azure_roles_authtype(); query.
  • Whether the major version upgrade succeeds after changing the authentication method.

This information will help us continue the investigation.

Looking forward to your update.

Was this answer helpful?

1 person found this answer helpful.
Answer accepted by question author
Christos Panagiotidis 3,551 Reputation points
2026-07-17T11:17:08.5566667+00:00

The role azure_pg_failover_slots_validator is created and owned by Azure's pg_failover_slots integration. It is not a customer role, and Flexible Server does not grant full PostgreSQL superuser access. Do not drop or alter it.

Run the major-version upgrade validation check and confirm this is the only blocker. Check whether pg_failover_slots is enabled in shared_preload_libraries. If you enabled the module and no longer use it, remove it from shared_preload_libraries, restart the server, remove the extension from each database where it is installed, and rerun validation. Test this on a point-in-time-restored server first.

If the module is not enabled, or validation still reports the Azure-managed role, the issue is not customer-remediable. Update your Azure support request with the server resource ID, source and target versions, validation output, operation correlation ID, and UTC timestamp. Ask the PostgreSQL Flexible Server team to correct the stale managed-role attribute. Rerun validation before attempting the upgrade again.

Was this answer helpful?

1 person found this answer helpful.
0 comments

3 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Julia 60 Reputation points
    2026-07-29T01:22:20.7066667+00:00

    RESOLVED - The issue was not individual role permissions, but a server parameter.

    The fix: (as suggested by the Microsoft staff above) The pre-check was failing because the server parameter azure.accepted_password_auth_method was set to md5.
    Changing it to scram-sha-256 via the Azure portal (Server Parameters) and restarting the server allowed the pre-check to pass and the upgrade to proceed.

    Why we initially investigated individual roles: The pre-check error message was a bit misleading -"Upgrading with password authentication mode enabled is not allowed... Please enable SCRAM and reset the passwords".
    We interpreted "reset the passwords" as referring to individual role password hashes (like azuresu, replication, azure_pg_failover_slots_validator), so we spent time troubleshooting whether Microsoft needed to re-hash those managed roles on the backend. On our end we changed password_ecnryption to scram-sha-256 and re-hashed admin roles.

    It turns out the error was actually about the azure.accepted_password_auth_method server parameter, which acts as a gate on the pre-check. Once that parameter is set to scram-sha-256, likely the pre-check trusts that you've handled password auth correctly.

    So:

    1. Check SHOW azure.accepted_password_auth_method;
    2. If it's md5, change it to scram-sha-256 via the Azure portal
    3. Restart the server
    4. Retry the pre-check

    Was this answer helpful?

    0 comments
  2. Julia 60 Reputation points
    2026-07-29T01:20:57.44+00:00

    RESOLVED - The issue was not individual role permissions, but a server parameter.

    The fix: (as suggested by the Microsoft staff above) The pre-check was failing because the server parameter azure.accepted_password_auth_method was set to md5.
    Changing it to scram-sha-256 via the Azure portal (Server Parameters) and restarting the server allowed the pre-check to pass and the upgrade to proceed.

    Why we initially investigated individual roles: The pre-check error message was a bit misleading -"Upgrading with password authentication mode enabled is not allowed... Please enable SCRAM and reset the passwords".
    We interpreted "reset the passwords" as referring to individual role password hashes (like azuresu, replication, azure_pg_failover_slots_validator), so we spent time troubleshooting whether Microsoft needed to re-hash those managed roles on the backend. On our end we changed password_ecnryption to scram-sha-256 and re-hashed admin roles.

    It turns out the error was actually about the azure.accepted_password_auth_method server parameter, which acts as a gate on the pre-check. Once that parameter is set to scram-sha-256, likely the pre-check trusts that you've handled password auth correctly.

    If you hit this:

    1. Check SHOW azure.accepted_password_auth_method;
    2. If it's md5, change it to scram-sha-256 via the Azure portal
    3. Restart the server
    4. Retry the pre-check

    Was this answer helpful?

    0 comments
  3. Pilladi Padma Sai Manisha 11,715 Reputation points Microsoft External Staff Moderator
    2026-07-17T18:37:21.5266667+00:00

    Hi @Julia
    The Major version upgrade from version 11 to 16 is failing on your Azure DB for PostgreSQL Flexible server due to pg_failover_slots_validator.

     

    We sincerely apologize for the inconvenience caused to you. We have observed that the pg_failover_slots extension is enabled in shared_preload_libraries server parameter which is leading to this error. We recommend you to follow the below steps to mitigate this issue:

     

    1. Navigate to your Azure Database for PostgreSQL Flexible Server.
    2. Open Server Parameters.
    3. Disable pg_failover_slots in shared_preload_libraries.

     

    From our end we have observed few unsupported extensions enabled on your server which will block the MVU like timescaledb. So, we recommend you to please follow the provided documentation to disable unsupported extensions: Major Version Upgrades - Azure Database for PostgreSQL | Microsoft Learn

    Major Version Upgrades - Azure Database for PostgreSQL | Microsoft Learn

     

    Previous Major version upgrade seems to have failed due to unsupported password encryption. Please follow the instructions provided in the following documentation to change the encryption to SCRAM-SHA-256 for the server and users: SCRAM Auhtentication in Azure Database for PostgreSQL Flexible Server - Azure Database for PostgreS…

     

    We also recommend reviewing the Microsoft documentation for Major Version Upgrades prior to performing the upgrade. The documentation provides details on prerequisites, supported upgrade scenarios, and known limitations that should be addressed before initiating the upgrade, helping to prevent precheck failures and ensure a successful upgrade:

    Major Version Upgrades - Azure Database for PostgreSQL | Microsoft Learn

     

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.