while importing an on-prem sqlserver 16 bacpac backup stored in azure blob, to create an azure sql database getting error

Question

What is wrong in here? How can I fix this issue.
Thanks,
Jai

{   "code": "ImportExportJobError",   "message": "The ImportExport operation with Request Id 'xxxx' failed due to 'The ImportExport operation with Request Id 'xxxx' failed due to 'An unexpected error was returned by SQL. Error number: 0, State: 0, Message: Failed to authenticate the user myuserid.onmicrosoft.com in Active Directory (Authentication=ActiveDirectoryPassword).\nError code 0xinvalid_grant\nAADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance. Trace ID: xxxx Correlation ID: xxxxx Timestamp: 2026-07-03 17:39:22Z.'.'." }

 

Answer 1

Hi @Jaiprakash Maurya ,

The error indicates that the BACPAC import operation is failing because Microsoft Entra ID authentication is being blocked by a Conditional Access policy:

AADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance.

The Azure SQL Import/Export service uses ActiveDirectoryPassword authentication in this scenario, and the import can fail if the Entra ID account is subject to Conditional Access requirements such as Multi-Factor Authentication (MFA). The Import/Export service does not support Entra ID authentication when MFA is required.

To resolve the issue, consider one of the following options:

1. Use SQL Authentication credentials for the Azure SQL Database import instead of an Entra ID account.
2. Use SqlPackage.exe to perform the BACPAC import if MFA or Conditional Access policies are enforced.
3. Review the Conditional Access policies applied to the account and confirm whether they are preventing token issuance for the import operation.

For additional information, please refer to the following documentation:

• https://learn.microsoft.com/azure/azure-sql/database/database-import?view=azuresql#use-azure-portal
• https://learn.microsoft.com/azure/azure-sql/database/database-import?view=azuresql#use-sqlpackage
• https://learn.microsoft.com/azure/azure-sql/database/database-import?view=azuresql#limitations

Please let us know whether you are using SQL Authentication or Microsoft Entra ID Authentication for the import operation, and we'll be happy to assist further.

Answer 2

Hi Jaiprakash,

The AADSTS53003 error means Conditional Access is blocking the token and the Import/Export service can't satisfy MFA because it's a non-interactive background operation. The service simply doesn't support Entra ID auth when MFA is enforced as mentioned by @Alberto Morillo .

Two fixes:

Use a SQL login for the import instead of your Entra account. SQL auth bypasses Conditional Access entirely.

Use managed identity authentication. Assign a user-assigned managed identity to the logical server, set it as the server's Entra admin, and grant it Storage Blob Data Reader on the container.

Tutorial: https://learn.microsoft.com/en-us/azure/azure-sql/database/database-import-export-managed-identity

Answer 3

Azure SQL Import/Export service does not support Microsoft Entra authentication when MFA is required, which is commonly enforced through Conditional Access. You can bypass this by using a SQL login instead to do the operation. You can also try to turn off MFA and try again.

A newer alternative, is to do the import/export operation using an identity as explained here.