Error while enabling SQL DB backup on Azure VM

Question

I'm trying to enable SQL DB backup on Azure VM running Windows Server 2019 Datacenter and getting error.

Error code: Resource Operation Failure

Message: The resource operation completed with terminal provisioning state 'failed'

Troubleshooting steps:

1. VM rebooted with no luck
2. Check VM agent running latest version
3. Re-tried operations and being greeted with the same error.

FYI: This is a production server. Please assist with further guidance to fix this issue.

Thanks!

Answer 1

Thanks for the update, WorkloadBackupExtensionInstallationTimedOut specifically means the AzureBackupWindowsWorkload extension could not complete its installation within the allowed time. This is typically caused by network connectivity issues, Guest Agent problems, conflicting extensions, or resource constraints on the VM.y

The extension installation requires the VM to download packages from Azure endpoints. A timeout usually means connectivity is blocked or slow.

From inside the VM (RDP), run the following in PowerShell:

# Test connectivity to required Azure Backup endpoints
Test-NetConnection -ComputerName management.azure.com -Port 443
Test-NetConnection -ComputerName login.microsoftonline.com -Port 443
Test-NetConnection -ComputerName *.blob.core.windows.net -Port 443
# Test access to Wire Server (required for all extensions)
Test-NetConnection -ComputerName 168.63.129.16 -Port 80
Test-NetConnection -ComputerName 168.63.129.16 -Port 32526

All connections must succeed. If any fail, check:

• NSG rules: Ensure outbound rules allow traffic to service tags: AzureBackup, AzureActiveDirectory, Storage, and AzureCloud.
• Windows Firewall: Ensure it's not blocking outbound HTTPS (TCP 443).
• Proxy: If the VM uses a proxy, ensure Azure endpoints are whitelisted.
• TLS 1.2: Ensure TLS 1.2 is enabled. Verify with: [Net.ServicePointManager]::SecurityProtocol
• If the output does not include Tls12, enable it via registry or GPO.

Check the Azure VM Guest Agent Health: The Guest Agent is responsible for downloading and installing all extensions. If it's unhealthy, extension installation will time out.

Inside the VM:

1. Open services.msc → Look for Windows Azure Guest Agent → Ensure it is Running.
2. Check the agent version — ensure it is the latest version.
3. Verify the agent log for errors:

C:\WindowsAzure\Logs\WaAppAgent.log

1. Also verify COM+ System Application is running (services.msc) and that the Distributed Transaction Coordinator service is running as Network Service account. [learn.microsoft.com]

If the Guest Agent is not responsive:

• Restart the WindowsAzureGuestAgent service.
• If it persists, consider reinstalling the Guest Agent from: https://go.microsoft.com/fwlink/?LinkID=394789.

Also a failed extension on the VM can block new extension installations.

1. Go to Azure Portal > VM > Extensions + applications.
2. Check if any extension shows a Failed provisioning state.
3. If the AzureBackupWindowsWorkload extension is listed in a failed state:
   • Uninstall it from the Extensions blade.
   • Wait for removal to complete, then retry the backup configuration (the extension will reinstall automatically).
4. If other extensions are in a failed state, resolve those first — they can block the backup extension installation.

Check VM Resource Utilization: Extension installation can time out if the VM is under high CPU or memory pressure:

• RDP into the VM > Open Task Manager or Resource Monitor.
• Check if CPU is consistently at 90%+ or memory is exhausted.
• If so, consider temporarily scaling up the VM or stopping non-critical workloads before retrying.

The workload backup extension requires.NET Framework 4.6.2 or above.

Check the installed version: (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full").Release

A value of 394802 or higher = .NET 4.6.2+. If lower, upgrade .NET Framework.

After completing the above checks:

1. Go to Recovery Services Vault > Backup Infrastructure > Protected Servers > Azure Workload.
2. Select the VM and choose Re-register (or re-discover databases).
3. Retry the backup configuration.

Hope this helps! If the information was useful, please consider Accepting the answer and upvoting. Feel free to reach out if you need further assistance. Thank you.

Answer 2

i think the fail comes from the SQL IaaS extension not registering right, and u can reinstall it under VM → Extensions and confirm Full mode, and check outbound https 443 for Azure Backup.

Answer 3

The error indicates that the Azure Backup workload extension or connectivity required for SQL backup on the VM is failing. Since reboot and VM agent checks did not help, the next steps are to validate extension health, connectivity, and re‑register the SQL workload extension.

Follow these steps in order:

1. Confirm the VM is running and reachable

• Ensure the VM is in the Running state in the Azure portal.
• Verify that SQL Server is up and running on the VM.

2. Check for common extension and connectivity errors

• In the Recovery Services vault, open the backup item for this SQL VM and check the latest failed job details for a specific error code such as:
  • WorkloadExtensionNotReachable
  • UserErrorVMInternetConnectivityIssue
  • UserErrorWindowsWLExtFailedToStartPluginService
• If you see:
  • WorkloadExtensionNotReachable: The VM is shut down or cannot contact Azure Backup.
    • Ensure the VM is running and has internet connectivity.
    • Then re‑register the extension on the SQL Server VM as described below.
  • UserErrorVMInternetConnectivityIssue: Outbound connectivity or TLS cipher issues.
    • If using NSGs, allow outbound access using service tags AzureBackup, AzureActiveDirectory, and Storage as described in the NSG tags section of the SQL backup documentation.
    • Ensure DNS resolves Azure endpoints.
    • Verify the VM is not behind a load balancer or firewall/proxy that blocks outbound calls to Azure Backup, Azure Storage, or Microsoft Entra ID.
    • If a GPO restricts TLS cipher suites, remove the VM from that GPO or modify it to allow the required cipher suites.
  • UserErrorWindowsWLExtFailedToStartPluginService: Workload plugin service cannot start due to permissions.
    • Ensure NT Service\AzureWLBackupPluginSvc has Read permissions on:
      • C:\Windows\Microsoft.NET\assembly\GAC_32
      • C:\Windows\Microsoft.NET\assembly\GAC_64
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config
    • In Local Security Policy → Local Policies → User Rights Assignment → Bypass traverse checking:
      • Ensure Everyone is present by default, and if missing, add NT Service\AzureWLBackupPluginSvc.
    • Restart the AzureWLBackupPluginSvc service (or retry the backup/enable‑protection operation).

3. Re‑register the SQL workload extension on the VM If backup/restore/configure operations are failing and the backup status shows Not reachable, or you see errors like WorkloadExtensionNotReachable / UserErrorWorkloadExtensionNotInstalled / WorkloadExtensionNotPresent / WorkloadExtensionDidntDequeueMsg, re‑register the extension:

• Typical causes include:
  • Extension deleted/uninstalled from the portal or Control Panel.
  • VM restored from an older point in time.
  • VM shut down for an extended period so extension configuration expired.
  • VM deleted and recreated with the same name.
  • Availability Group node not fully registered.
• Use the documented re‑register extension on the SQL Server VM procedure (PowerShell or portal) and then retry Discover DBs in VMs and Configure Backup.

4. Verify SQL backup registration and vault association

• Ensure the VM is registered for SQL backup in the same Recovery Services vault where backups are being configured.
• If the VM was previously registered in a different vault, it must be unregistered from that vault first. This requires:
  • Stopping protection for all protected data sources.
  • Deleting backed‑up data (destructive operation; review carefully before doing this in production).
• After unregistering from the old vault, register the VM with the correct vault and retry discovery/configure backup.

5. Retry the enable‑backup operation

• After fixing connectivity, extension, and registration issues, retry Configure Backup for the SQL databases from the Recovery Services vault.

If the job still fails with a generic “Resource Operation Failure” but a more specific error code is present in job details, use that code with the error tables in the SQL backup troubleshooting article to apply the corresponding recommended action.

---

References:

• Troubleshoot SQL Server database backup by using Azure Backup