Azure backup registration failure

Question

We have been deploying azure backup to our servers using the same script successfully for the last 6 months or so. In the last fortnight I have been unable to deploy it to any new devices. I have run through running each line of the script manually on the target server with the same result. I also tried doing the registration via the azure backup MARS agent gui and downloading the vault credentials then attempting registration, and got the same error message. Can you please advise what the issue may be here? I did wait a day and try again with the same error below each time. I have tried it with the latest 3 MARS agents as well all with the same result. Output below:

Account : XXXX@xxxxxxxxxxxxx .onmicrosoft.com
SubscriptionName : XXXX
SubscriptionId : XXXX
TenantId : XXXX
Environment : AzureCloud

FilePath : C:\windows\temp\WorkstationBackup_Tue Jun 30 2020.VaultCredentials

Vault credentials validation succeeded. Below are the backup vault details.

ExtensionData : System.Runtime.Serialization.ExtensionDataObject
CertThumbprint : XXXX
Region : XXXX
ResourceID : XXXX
ServiceResourceName : XXXX
SubscriptionID : XXXX

WARNING: Machine registration failed.
Start-OBRegistration : Microsoft Azure Backup encountered an internal error. Wait for a few minutes and then try the
operation again. If the issue persists, please contact Microsoft support.

• Start-OBRegistration -VaultCredentials $cred -Confirm:$false
• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  • CategoryInfo : NotSpecified: (:) [Start-OBRegistration], DlsException
  • FullyQualifiedErrorId : CloudInternalError,Microsoft.Internal.CloudBackup.Commands.StartCBRegistrationCommand

Id : XXXX@xxxxxxxxxxxxx .onmicrosoft.com
Type : User
Tenants : {XXXX}
AccessToken :
Credential :
TenantMap : {}
CertificateThumbprint :
ExtendedProperties : {[Tenants, XXXX]}

Answer 1

I saw this in the log:

WARNING Exception in GetAADToken | Params: {Data = }{Message = AADSTS700027: Client assertion contains an invalid signature. [Reason - The key was not found.

I checked the certificate store and saw 2 certificates for Windows Azure Tools. Once from the first time I tried to set this up about 15 days old, and one dated today. I deleted them both, then re ran through the script and it was registered successfully! Thank you for the hint.