accessiong the secondary on a ra-gzrs storage account with an sql restore.

Question

accessiong the secondary on a ra-gzrs storage account with an sql restore.

Tony Roth 0

so I can list the contents via azcopy -list but I can't do a sql db restore from it, get an access denied error, I have tried with sp=r and sp=rl but no luck. I know the sastoken is correct since i use the same token for the azcopy -list, any ideas.

thanks

Tony Roth 0 Reputation points

2026-02-18T03:14:42.8833333+00:00

so not wanting to fail it over since I should be able to read the from the secondary, I can access both the primary and secondary via azcopy cp to download the files. in sql I can access the primary just fine can't access the secondary. the following is the error message. I use the same sas token for both the azcopy and sql credential.

Operating system error 5(Access is denied.).

Msg 3013, Level 16, State 1, Line 7

RESTORE DATABASE is terminating abnormally.
Praveen Bandaru 10,720 Reputation points Microsoft External Staff Moderator

2026-02-20T21:03:41.72+00:00

Hello **Tony Roth

Thank you for your response. If possible, could you share the Case Number so I can monitor the case on my end. You mentioned that you are able to access properly with Azcopy but not at the SQL level. Based on my understanding, there are no issues at the storage level, and the problem is only at the SQL level. Please consider opening a new case for SQL as well for a more thorough investigation.

2 answers

Your answer

Tony Roth 0 Reputation points

2026-02-18T03:14:42.8833333+00:00

so not wanting to fail it over since I should be able to read the from the secondary, I can access both the primary and secondary via azcopy cp to download the files. in sql I can access the primary just fine can't access the secondary. the following is the error message. I use the same sas token for both the azcopy and sql credential.

Operating system error 5(Access is denied.).

Msg 3013, Level 16, State 1, Line 7

RESTORE DATABASE is terminating abnormally.
Praveen Bandaru 10,720 Reputation points Microsoft External Staff Moderator

2026-02-20T21:03:41.72+00:00

Hello **Tony Roth

Thank you for your response. If possible, could you share the Case Number so I can monitor the case on my end. You mentioned that you are able to access properly with Azcopy but not at the SQL level. Based on my understanding, there are no issues at the storage level, and the problem is only at the SQL level. Please consider opening a new case for SQL as well for a more thorough investigation.

Answer 1

Hello **Tony Roth
**I understand that you are facing issue with restoring an Azure SQL Database from a secondary (geo-replication) location due to access denied errors.

Please share the error screen shot for further investigation on the issue.
Are you currently working with a primary or geo-secondary database?
Have you attempted to initiate a failover to the geo-secondary?

Backups for Azure SQL Databases are handled by Microsoft, and geo-secondary databases do not allow direct restores from their backups. To restore, you must first fail over the geo-secondary database and make it the primary.

If you encounter the BlockRestoreOnVldbGeoSecondary error, promote the geo-secondary database to primary by initiating a failover through the Azure portal, T-SQL, PowerShell, or Azure CLI.
Once the failover is complete, you can proceed with the restore operation from the new primary database.
Check the below reference document for more understanding:

https://learn.microsoft.com/en-us/azure/azure-sql/database/recovery-using-backups?view=azuresql&tabs=azure-portal

I have also initiated a private message. Please check it and provide the necessary information so we can discuss further on your concern.

Answer 2

It sounds like you're encountering issues with permissions when trying to restore a SQL database from an Azure Blob Storage account using a SAS token. Here are a few things to check:

SAS Token Permissions: Ensure that the SAS token you are using has the correct permissions for both reading (sp=r) and listing (sp=l) the contents of the storage account. Since you mentioned using both sp=r and sp=rl, ensure that the token is not expired and is correctly formatted.
Network Access: Verify that there are no network access restrictions that might be blocking the SQL Server from accessing the Azure Blob Storage. Ensure that the SQL Server has the necessary outbound access to the storage account.
Firewall Settings: Check if the Windows Firewall settings on the host where SQL Server is running allow outbound connections to the Azure Blob Storage.
Storage Account Configuration: Make sure that the storage account is configured to allow access from the SQL Server. This includes checking service endpoints and ensuring that the SQL Server is in the same virtual network if applicable.
Error Messages: If you receive specific error messages during the restore operation, those can provide additional clues. For example, if the error indicates access is denied, it may point to an issue with the SAS token or network configuration.

If everything seems correct and you are still facing issues, consider regenerating the SAS token and trying again.

References:

Error messages

Tony Roth 0 Reputation points

2026-02-17T16:21:48.8833333+00:00

these were all check sastoken is fine. no firewall nonetwork issue etc since I can do the azcopy -list just fine.

Share via

accessiong the secondary on a ra-gzrs storage account with an sql restore.

2 answers

Your answer