One account is unable to generate a security key

Joshua Cousins 0

We are having an issue generating a security key to change a local MARS backup job on one of our accounts. This particular account has the Backup Operator permission and when trying to generate the security key under Settings > Properties > Security PIN > Generate for the resource group. It opens the Windows and just says "Loading ...", I've left it for a while and nothing loads. I tried these steps on an administrator account that has access to everything and they have been able to generate the Security PIN. How to we add permission to give the first account access to this without changing their other permissions from Backup Operator?

SadiqhAhmed-MSFT 37,686 Reputation points Microsoft Employee

2024-03-28T18:58:56.92+00:00
@Joshua Cousins It seems like the issue is related to the permission of the user account that is trying to generate the security key. As you mentioned, the user account has the Backup Operator permission, which should be sufficient to generate the security key. However, it's possible that there are some other permission issues that are preventing the user account from generating the key.

To troubleshoot this issue, you can try the following steps:

Check if the user account has the necessary permissions to access the resource group that the backup job is associated with. You can do this by going to the resource group in the Azure portal and checking the access control (IAM) settings. Make sure that the user account has the Backup Operator role assigned to it.

Check if the user account has the necessary permissions to access the backup vault that the backup job is associated with. You can do this by going to the backup vault in the Azure portal and checking the access control (IAM) settings. Make sure that the user account has the Backup Operator role assigned to it.

Try generating the security key using a different web browser or clearing the cache and cookies of the current web browser.

If the issue persists, try generating the security key using PowerShell. You can use the New-AzRecoveryServicesBackupProtectionIntent cmdlet to generate the security key. Here's an example:

New-AzRecoveryServicesBackupProtectionIntent -ResourceGroupName "ResourceGroupName" -VaultName "VaultName" -ContainerType "AzureVM" -ItemName "VMName" -PolicyId "PolicyId" -StorageAccountId "StorageAccountId" -SecurityPIN "SecurityPIN"

Replace the ResourceGroupName, VaultName, VMName, PolicyId, StorageAccountId, and SecurityPIN with the appropriate values for your backup job.

Note: Earlier it used to be an issue that got resolved by updating the Agent. It is detailed here - https://support.microsoft.com/en-us/topic/mandatory-update-for-azure-backup-for-microsoft-azure-recovery-services-agent-411e371c-aace-e134-de6b-bf9fda48026e

Download the latest version of the Azure Backup agent

If none of these step's work, you may need to contact Microsoft Azure technical support for further assistance.
Joshua Cousins 0 Reputation points

2024-04-05T10:25:37.7366667+00:00
Sorry for the late reply, please see the below:

I have checked and the account has the Backup Operator role assigned to the resource group.

I have checked and the backup vault inherits permissions from the resource group and it has brought over the Backup Operator role for the user account.

I have tried two different browsers and another machine but same issue.

I would run through the script supplied but the machine is not a VM. It looks like you require the SecurityPIN in the script.

I checked the version of MARS on the machine and it is on 2.0.9266.0 which is higher than the bug fix with update 2.0.9190.0 mentioned in the article supplied.
SadiqhAhmed-MSFT 37,686 Reputation points Microsoft Employee

2024-04-06T20:59:29.94+00:00

@Joshua Cousins Sorry for the painful experience. Please contact Azure technical support team for further assistance by raising a support ticket.