Azure VM's "status unknown"

Question

I have an environment in Azure protected by a Sophos XG virtual firewall. The two vm's are Server 2012 R2 datacenter. One - the domain controller - has just begun displaying "status unknown". The other, terminal server, probably will soon. This scenario happened in another similar deployment and sophos' recommendation is to get to safe mode to disable the tamper protection service. Trouble is that you can't boot an Azure VM to safe mode. The recommendation is to delete and recreate the VM (retaining the disks). Not a sustainable workaround not knowing the underlying cause: https://sophos.com/kb/127602 
 
 I am strongly considering against using Sophos Advanced Server Protection which is a bummer. 
 
 Is anyone running into this and if so is there a root cause?

StephenMcKay · Accepted Answer

Hello, 
 There is an open investigation into reports of the health service returning an unknown status. In order to ensure that this is the same issue and to help you resolve it you would need to log a support call. 
 I will ensure that your call gets escalated, please PM me the case ID when you get it. 
 https://secure2.sophos.com/en-us/support/contact-support.aspx 
 Stephen