Azure file Backup Issue

Question

My organization policy disables storage account key-based authentication. As a result, Azure Backup for an Azure File Share is failing with UserErrorStorageKeyBasedAuthenticationNotPermitted. We attempted to use managed identity/RBAC for the vault, but the backup job still fails.

What is the Microsoft-supported solution or compliant alternative approach to back up Azure File Shares under a “no shared keys” policy.

Answer 1

Below Azure Support reply

At this time, there is no supported alternative to use Azure Backup for Azure File Shares without enabling storage account key access. As documented in the Azure Files backup support matrix, the source storage account must have Allow storage account key access = Enabled for backup and restore operations. Managed Identity or RBAC cannot be used for this scenario today.

 

If enabling key-based access is not possible due to organizational policy, any viable alternatives would be outside of Azure Backup, still a possible solution would be:

• Custom backup approaches, such as file share snapshots combined with copy/export mechanisms to another secured storage account (not managed or supported by Azure Backup).

 

From a Microsoft support perspective, Azure Backup will continue to fail by design while key-based authentication is blocked. The supported path to forward is a policy exception for this storage account.

 

 

Answer 2

At this time, there is no supported alternative to use Azure Backup for Azure File Shares without enabling storage account key access. As documented in the Azure Files backup support matrix, the source storage account must have Allow storage account key access = Enabled for backup and restore operations. Managed Identity or RBAC cannot be used for this scenario today.

 

If enabling key-based access is not possible due to organizational policy, any viable alternatives would be outside of Azure Backup, still a possible solution would be:

Custom backup approaches, such as file share snapshots combined with copy/export mechanisms to another secured storage account (not managed or supported by Azure Backup).

 

From a Microsoft support perspective, Azure Backup will continue to fail by design while key-based authentication is blocked. The supported path to forward is a policy exception for this storage account.

References:

• Backup is failing
• What are the permissions used by Azure Backup during backup operation?

Answer 3

To back up Azure File Shares under a policy that disables storage account key-based authentication, you can use the following Microsoft-supported solution:

1. Managed Identity: Ensure that you have configured a managed identity for your Recovery Services vault. This allows Azure Backup to authenticate without using storage account keys.
2. Role-Based Access Control (RBAC): Assign the necessary roles to the managed identity to ensure it has the required permissions to access the Azure File Share. This typically includes the Backup Contributor role on the storage account.
3. Network Configuration: Verify that your storage account's network configuration allows access from the Azure Backup service. You may need to check firewall settings and ensure that the exception for Azure services is enabled.

If you have already attempted these steps and the backup job still fails, ensure that the managed identity is correctly set up and that it has the appropriate permissions. If issues persist, consider reaching out to Microsoft support for further assistance.

---

References:

• Troubleshoot problems while backing up Azure Files
• Back up Azure Files