Enabling backup on existing Windows VM fails with error BMSUserErrorContainerObjectNotFound

Question

Enabling backup on existing Windows VM fails with error BMSUserErrorContainerObjectNotFound

F. Butnariu 25

Hi everyone,

I am facing an issue related to Azure Backup.

When I attempt to enable backup on an existing Windows VM to an existing recovery services vault in the same region by using an enhanced backup policy, then the operation fails due to error BMSUserErrorContainerObjectNotFound.

Attempts to enable backup from the VM pane in the Azure portal fail.

Attempts to enable backup from PowerShell or Azure CLI fail.

The Windows VM was not previously protected by Azure Backup.

The Windows VM is compatible with Azure Backup based on the Azure VM backup support matrix.

The issue was also observed with a different Windows VM in the same region and in the same Azure subscription, which was not previously protected.

Can you provide assistance around this issue?

Thank you in advance for your help.

Naveena Patlolla 3,605 Reputation points Microsoft External Staff Moderator

2025-06-03T02:41:26.03+00:00
Hi F. Butnariu

It seems like the backup infrastructure is unable to locate or register the VM's container in the Recovery Services Vault. In Recovery Services Vault ->Backup jobs tab: see if any registration job failed

To Resolve the issue please follow the below steps:

1.Re-register the VM with the Recovery Services Vault This will force Azure Backup to re-sync and properly register the container object.

2.To ensure the Azure Backup and Microsoft Recovery Services resource providers are registered:

az provider register --namespace Microsoft.RecoveryServices az provider register --namespace Microsoft.AzureBackup

The VM and vault are in the same region and same subscription.

The VM must not have any snapshots pending or inconsistent extensions.

Feel free to reach out if you have any further concerns. We're here to help you.

If the comment was helpful, please click "Upvote"
F. Butnariu 25 Reputation points

2025-06-03T07:45:41.7766667+00:00
Hi Naveena,

Thank you for your reply.

Regarding the Windows VM, there is indeed a failed Configure backup operation listed under Backup Jobs in the recovery services vault. The details of the failed operation include the following error details:

Error Code: BMSUserErrorContainerObjectNotFound

Error message: Item not found

Recommended action: Item could have been deleted. Please check if item is present in Backup Items.

I checked and the Windows VM in not present in Backup items.

I attempted to re-register the Windows VM by enabling backup from the VM pane in the Azure portal, but error BMSUserErrorContainerObjectNotFound occurs.

2 . Providers Microsoft.RecoveryServices and Microsoft.AzureBackup are registered with my Azure subscription.

The Windows VM and the recovery services vault are in the same region.

The Windows VM does not have pending snapshots and inconsistent extensions.

Can you provide further assistance around this issue?

Thank you in advance for your help.
Naveena Patlolla 3,605 Reputation points Microsoft External Staff Moderator

2025-06-04T17:04:54.43+00:00

Hi F. Butnariu
We are testing in our environment and will update you soon.
Vinay B 500 Reputation points Microsoft External Staff Moderator

2025-06-05T16:33:49.3133333+00:00
Hello F. Butnariu,

Thank you for the detailed investigation and confirmations so far. Since the work around shared doesn't helps you I came up with few alternatives you can look into

Try Force Registration via Azure REST API because there are cases where Azure PowerShell/CLI does not trigger re-registration properly. Use the following REST API: Post

https://management.azure.com/Subscriptions/{subscriptionId}/resourceGroups/{rgName}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/backupFabrics/Azure/protectionContainers/{vmResourceId}/register?api-version=2023-02-01

Refer: https://learn.microsoft.com/en-us/rest/api/backup/protection-containers/register?view=rest-backup-2025-02-01&tabs=HTTP

Have you tried checking Diagnostic Settings for Backup Agent Logs Navigate to your Recovery Services Vault > Monitoring > Diagnostic Settings, and ensure logs are enabled.

Refer: https://learn.microsoft.com/en-us/samples/azure/azure-quickstart-templates/recovery-services-create-vault-enable-diagnostics/

You also mentioned you're using a private endpoint, DNS resolution and private link routing for the vault's FQDN (*.backup.windowsazure.com) must resolve correctly from the VM.

Use the PowerShell command

Resolve-DnsName <yourVaultName>.backup.windowsazure.com

Refer: https://learn.microsoft.com/en-us/azure/backup/private-endpoints-overview#dns-configuration

Since the issue persists across vaults in the same region, also try provisioning a new vault in a different resource group.

Please let us know if it was helpful, and feel free to reach out if you have any further queries.
Vinay B 500 Reputation points Microsoft External Staff Moderator

2025-06-06T10:06:05.9366667+00:00

Hi F. Butnariu,

We haven’t heard from you on the last response, and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, please respond with more details and we will try to help.
F. Butnariu 25 Reputation points

2025-06-06T14:31:17.5433333+00:00
Hi Vinay,

Thank you for your assistance. Unfortunately, the issue continues to occur.

Attempts to register a container for one of the affected Windows VMs with the recovery services vault by using the indicated REST API fails with response code 500. The repose body is given below.

{ "error": { "code": "CloudInternalError", "message": "Microsoft Azure Backup encountered an internal error. Wait for a few minutes and then try the operation again. If the issue persists, please contact Microsoft support." } }

The private endpoint of the recovery services vault is integrated with the following private DNS zones:

privatelink.we.backup.windowsazure.com,

privatelink.queue.core.windows.net, and

privatelink.blob.core.windows.net.

This private DNS integration is provided in the flow to Create a private endpoint for an existing recovery services vault in the Azure portal.

Looking in the Azure portal at the private endpoint > Settings > DNS Configuration, each FQDN listed there is resolved to the correct IP address on the affected Windows VMs.

I deployed a new publicly-accessible recovery services vault to a different resource group. In addition, I added diagnostic settings to this recovery services vault as documented here. Attempts to enable backup on the affected VMs to the new recovery services vault also fail due to error BMSUserErrorContainerObjectNotFound.
Vinay B 500 Reputation points Microsoft External Staff Moderator

2025-06-06T16:59:15.7166667+00:00

Hi F. Butnariu,

Will try to work on this in my environment and refer some doc and get back to you on this thanks for the patience.
Vinay B 500 Reputation points Microsoft External Staff Moderator

2025-06-09T09:45:17.1033333+00:00
Hello F. Butnariu,

Thank you for your detailed updates and troubleshooting efforts. The Details you mentioned is points to an issue beyond just configuration it is likely a metadata registration mismatch or stale container reference in the Azure Backup fabric backend.

The internal backup metadata cache might be stale. While this isn't user-accessible directly, you can trigger metadata refresh by following these indirect steps:

Temporarily move the VM to a different resource group, wait a few minutes, and then move it back.

Then retry the registration to the vault.

Refer: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources#azure-backup

Use the following API to validate what containers are visible to the vault fabric:

GET https://management.azure.com/Subscriptions/{subscriptionId}/resourceGroups/{rg}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/backupFabrics/Azure/protectionContainers?api-version=2023-02-01

Refer:

https://learn.microsoft.com/en-us/rest/api/backup/protection-containers/list?view=rest-backup-2016-06-01&viewFallbackFrom=rest-backup-2025-02-01&tabs=HTTP

Please try these & share the outcomes here

Please let us know if it was helpful, and feel free to reach out if you have any further queries.
Vinay B 500 Reputation points Microsoft External Staff Moderator

2025-06-10T07:44:46.8266667+00:00

Hi F. Butnariu,

We haven’t heard from you on the last response, and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, please respond with more details and we will try to help.
F. Butnariu 25 Reputation points

2025-06-23T18:31:43.2233333+00:00

Hi Vinay,

Thank you for your reply.

I moved one of the affected Windows VMs to temporary resource group, then moved it back to its initial resource group, and reattempted to enable backup. Unfortunately, error BMSUserErrorContainerObjectNotFound continues to occur.

Only one container is registered with the recovery services vault, and that container corresponds to a different Windows VM for which backup was successfully enabled.

Would it be possible to escalate this issue?

1 answer

Your answer

Naveena Patlolla 3,605 Reputation points Microsoft External Staff Moderator

2025-06-03T02:41:26.03+00:00

Hi F. Butnariu

It seems like the backup infrastructure is unable to locate or register the VM's container in the Recovery Services Vault. In Recovery Services Vault ->Backup jobs tab: see if any registration job failed

To Resolve the issue please follow the below steps:

1.Re-register the VM with the Recovery Services Vault This will force Azure Backup to re-sync and properly register the container object.

2.To ensure the Azure Backup and Microsoft Recovery Services resource providers are registered:

az provider register --namespace Microsoft.RecoveryServices az provider register --namespace Microsoft.AzureBackup

The VM and vault are in the same region and same subscription.

The VM must not have any snapshots pending or inconsistent extensions.

Feel free to reach out if you have any further concerns. We're here to help you.

If the comment was helpful, please click "Upvote"
F. Butnariu 25 Reputation points

2025-06-03T07:45:41.7766667+00:00

Hi Naveena,

Thank you for your reply.

Regarding the Windows VM, there is indeed a failed Configure backup operation listed under Backup Jobs in the recovery services vault. The details of the failed operation include the following error details:

Error Code: BMSUserErrorContainerObjectNotFound

Error message: Item not found

Recommended action: Item could have been deleted. Please check if item is present in Backup Items.

I checked and the Windows VM in not present in Backup items.

I attempted to re-register the Windows VM by enabling backup from the VM pane in the Azure portal, but error BMSUserErrorContainerObjectNotFound occurs.

2 . Providers Microsoft.RecoveryServices and Microsoft.AzureBackup are registered with my Azure subscription.

The Windows VM and the recovery services vault are in the same region.

The Windows VM does not have pending snapshots and inconsistent extensions.

Can you provide further assistance around this issue?

Thank you in advance for your help.
Naveena Patlolla 3,605 Reputation points Microsoft External Staff Moderator

2025-06-04T17:04:54.43+00:00

Hi F. Butnariu
We are testing in our environment and will update you soon.
Vinay B 500 Reputation points Microsoft External Staff Moderator

2025-06-05T16:33:49.3133333+00:00

Hello F. Butnariu,

Thank you for the detailed investigation and confirmations so far. Since the work around shared doesn't helps you I came up with few alternatives you can look into

Try Force Registration via Azure REST API because there are cases where Azure PowerShell/CLI does not trigger re-registration properly. Use the following REST API: Post

https://management.azure.com/Subscriptions/{subscriptionId}/resourceGroups/{rgName}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/backupFabrics/Azure/protectionContainers/{vmResourceId}/register?api-version=2023-02-01

Refer: https://learn.microsoft.com/en-us/rest/api/backup/protection-containers/register?view=rest-backup-2025-02-01&tabs=HTTP

Have you tried checking Diagnostic Settings for Backup Agent Logs Navigate to your Recovery Services Vault > Monitoring > Diagnostic Settings, and ensure logs are enabled.

Refer: https://learn.microsoft.com/en-us/samples/azure/azure-quickstart-templates/recovery-services-create-vault-enable-diagnostics/

You also mentioned you're using a private endpoint, DNS resolution and private link routing for the vault's FQDN (*.backup.windowsazure.com) must resolve correctly from the VM.

Use the PowerShell command

Resolve-DnsName <yourVaultName>.backup.windowsazure.com

Refer: https://learn.microsoft.com/en-us/azure/backup/private-endpoints-overview#dns-configuration

Since the issue persists across vaults in the same region, also try provisioning a new vault in a different resource group.

Please let us know if it was helpful, and feel free to reach out if you have any further queries.
Vinay B 500 Reputation points Microsoft External Staff Moderator

2025-06-06T10:06:05.9366667+00:00

Hi F. Butnariu,

We haven’t heard from you on the last response, and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, please respond with more details and we will try to help.
F. Butnariu 25 Reputation points

2025-06-06T14:31:17.5433333+00:00

Hi Vinay,

Thank you for your assistance. Unfortunately, the issue continues to occur.

Attempts to register a container for one of the affected Windows VMs with the recovery services vault by using the indicated REST API fails with response code 500. The repose body is given below.

{ "error": { "code": "CloudInternalError", "message": "Microsoft Azure Backup encountered an internal error. Wait for a few minutes and then try the operation again. If the issue persists, please contact Microsoft support." } }

The private endpoint of the recovery services vault is integrated with the following private DNS zones:

privatelink.we.backup.windowsazure.com,

privatelink.queue.core.windows.net, and

privatelink.blob.core.windows.net.

This private DNS integration is provided in the flow to Create a private endpoint for an existing recovery services vault in the Azure portal.

Looking in the Azure portal at the private endpoint > Settings > DNS Configuration, each FQDN listed there is resolved to the correct IP address on the affected Windows VMs.

I deployed a new publicly-accessible recovery services vault to a different resource group. In addition, I added diagnostic settings to this recovery services vault as documented here. Attempts to enable backup on the affected VMs to the new recovery services vault also fail due to error BMSUserErrorContainerObjectNotFound.
Vinay B 500 Reputation points Microsoft External Staff Moderator

2025-06-06T16:59:15.7166667+00:00

Hi F. Butnariu,

Will try to work on this in my environment and refer some doc and get back to you on this thanks for the patience.
Vinay B 500 Reputation points Microsoft External Staff Moderator

2025-06-09T09:45:17.1033333+00:00

Hello F. Butnariu,

Thank you for your detailed updates and troubleshooting efforts. The Details you mentioned is points to an issue beyond just configuration it is likely a metadata registration mismatch or stale container reference in the Azure Backup fabric backend.

The internal backup metadata cache might be stale. While this isn't user-accessible directly, you can trigger metadata refresh by following these indirect steps:

Temporarily move the VM to a different resource group, wait a few minutes, and then move it back.

Then retry the registration to the vault.

Refer: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources#azure-backup

Use the following API to validate what containers are visible to the vault fabric:

GET https://management.azure.com/Subscriptions/{subscriptionId}/resourceGroups/{rg}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/backupFabrics/Azure/protectionContainers?api-version=2023-02-01

Refer:

https://learn.microsoft.com/en-us/rest/api/backup/protection-containers/list?view=rest-backup-2016-06-01&viewFallbackFrom=rest-backup-2025-02-01&tabs=HTTP

Please try these & share the outcomes here

Please let us know if it was helpful, and feel free to reach out if you have any further queries.
Vinay B 500 Reputation points Microsoft External Staff Moderator

2025-06-10T07:44:46.8266667+00:00

Hi F. Butnariu,

We haven’t heard from you on the last response, and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, please respond with more details and we will try to help.
F. Butnariu 25 Reputation points

2025-06-23T18:31:43.2233333+00:00

Hi Vinay,

Thank you for your reply.

I moved one of the affected Windows VMs to temporary resource group, then moved it back to its initial resource group, and reattempted to enable backup. Unfortunately, error BMSUserErrorContainerObjectNotFound continues to occur.

Only one container is registered with the recovery services vault, and that container corresponds to a different Windows VM for which backup was successfully enabled.

Would it be possible to escalate this issue?

Answer 1

hi there F. Butnariu)) thanks for posting this question, it's a real head-scratcher....

so u're hitting this 'bmsusererrorcontainerobjectnotfound' error when trying to enable backup on ur windows vm, right? the error usually pops up when azure backup can't find the vm in the recovery services vault's inventory. even if u swear u never backed it up before, sometimes azure gets... confused )at least to me).

go to ur recovery services vault. click on 'backup infrastructure' in the left menu. then select 'protected servers' under 'management servers'. look for ur vm in the 'azure backup agent' tab. if it's there (even as a ghost entry), delete it. this often clears up the confusion. microsoft docs azure backup troubleshooting guide

next, let's nuke any leftover metadata. open cloud shell or powershell

$vault = get-azrecoveryservicesvault -name "urvaultname"
$container = get-azrecoveryservicesbackupcontainer -containerType "azurevm" -status "registered" -vaultId $vault.id

if u see ur vm in the list, deregister it with

unregister-azrecoveryservicesbackupcontainer -container $container[0] -force -vaultId $vault.id

still no luck..... try to uninstall the backup extension manually from the vm. go to azure portal, find ur vm, click "extensions" under settings, and remove anything related to backup (might be called "iaasvmprovider" or similar). then reboot the vm for good measure. microsoft says this helps in stubborn cases: manage backup extensions

after all this, wait like 10 minutes (azure needs its coffee breaks too hahaha ) then try enabling backup again from scratch. start fresh from the vm's blade in the portal, not from the vault.

check if ur vm has any funky networking stuff going on. sometimes nsg rules or private endpoints block the backup service from doing its thing. the backup service needs outbound internet access or proper private link setup backup networking requirements

if none of this works... well, that's when u might need to open a support ticket. but 9 times outta 10, the steps above should get u past that pesky error. let me know how it goes....

cheers,

Alex

and "yes" if you would follow me at Q&A - personaly thx.
P.S. If my answer help to you, please Accept my answer
PPS That is my Answer and not a Comment

https://ctrlaltdel.blog/

F. Butnariu 25 Reputation points

2025-06-03T13:48:04.3466667+00:00

Hi Alex,

Thank you for your reply.

I can confirm that the affected Windows VM is not listed under my recovery services vault > Backup Infrastructure > Protected Servers > Azure Backup Agent.

I can also confirm that cmdlet Get-AzRecoveryServicesBackupContainer does not return a container corresponding to the affected Windows VM.

My understanding is that enabling backup from the VM pane (as shown in the screenshot below), corresponds to the first supported scenario, which uses an extension to the Azure VM agent. I inspected the extension status for the affected Windows VM. All Statuses and Substatuses indicate that Provisioning succeeded.

In my initial post, I stated that the issue was also observed with a different Windows VM in the same region and in the same Azure subscription. What the affected VMs have in common is that they were both deployed a few weeks ago. The affected VMs were deployed from different Azure Marketplace images, which come with the Azure VM agent installed by default. Backup was not enabled during or after provisioning on the affected VMs. At this later time, attempts to enable backup on both VMs fail. Attempts to enable backup to a different recovery services vault in the same region also fail.

Regarding networking, public access to the recovery services vault is disabled, while private access is allowed via a private endpoint. For the past few weeks, backup has been enabled and has been working as expected for a different Windows VM to the same recovery services vault, which likely indicates that networking is not a contributing factor to this issue.

Share via

Enabling backup on existing Windows VM fails with error BMSUserErrorContainerObjectNotFound

1 answer

Your answer