Hi Team, I am receiving alerts which says the Backup Failure for my Virtual machines, I am not able to fix the issue could you please check and do the needful. This was the Recommended actions suggest by not not able to understand this. Please grant the required permissions to the Azure Backup Service. For more details, refer to http://aka.ms/UserErrorKeyVaultPermissionsNotConfigured

Hi Pradeep Khantwal , You need to grant permissionto you keyvault to backup service. If you have the backup and keyvault configuration by default , that's meaning with backup system assgined identity and Key vault with access policies enable you can solve in this way: Go to Azure portal > Key vaults > your vault > Access policies. Click “Backup Management Service”. For Secret permissions, select Get, List, Backup, Restore. Click OK, then Save. If you have a custom configuration on you azure backup and Keyvault you might need to ensure Azure Backup Service has the right role (Backup Contributor) Let me know if this help you, Luis

Microsoft Defender for Cloud

Accepted answer

Luis Arias 7,686 Reputation points

2024-02-16T10:17:32.8866667+00:00
Hi Pradeep Khantwal,

You need to grant permissionto you keyvault to backup service. If you have the backup and keyvault configuration by default , that's meaning with backup system assgined identity and Key vault with access policies enable you can solve in this way:

Go to Azure portal > Key vaults > your vault > Access policies.

Click “Backup Management Service”.

For Secret permissions, select Get, List, Backup, Restore.

Click OK, then Save.

If you have a custom configuration on you azure backup and Keyvault you might need to ensure Azure Backup Service has the right role (Backup Contributor)

Let me know if this help you, Luis
Please sign in to rate this answer.
Pradeep Khantwal 55 Reputation points

2024-02-16T10:32:13.1233333+00:00

Hi @Luis Arias , Actually we had a tenant migration happened in last month. I am not aware about the back up key-vaults. How can I identify the backup key vault for the VM's which are running. If it's not present then should I create a new one, will it not cause any duplicity how to validate it also.
Or what are the things I should keep in mind before creating a new backup/key-vault. Thanks,

Luis Arias 7,686 Reputation points

2024-02-16T12:37:34.9733333+00:00

Hi again, You can identify the backup key vault for your VMs, you can use Azure PowerShell or Azure CLI, Like this might you need to update:

Connect-AzAccount $vaultname="your KeyVault name" $virtualmachine=Get-AzVM -Name "your VM name" $sp = Get-AzADServicePrincipal -displayname $virtualmachine.Name $id=$sp.Id $keyvault= Get-AzKeyVault -VaultName $vaultname $obj=$keyvault.AccessPolicies.ObjectId if ($obj -eq $sp.Id) { Write-Output "The VM is associated with the key vault" } else { Write-Output "The VM is not associated with the key vault" }

About other considerations or limitiation on Key vault backup you can find a better information here: https://learn.microsoft.com/en-us/azure/key-vault/general/backup?tabs=azure-cli Let me know any doubt, If this information help you to address your question please accept the answer.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Microsoft Defender for Cloud

0 additional answers

Your answer