Azure Backup failing - need technical support

Hello Planact IT Admin Thank you for posting your query on Microsoft Q&A platform. This specific failure happens when the VMSnapshot extension can’t complete the application‑consistent snapshot because either permissions, policy/locks, agent/extension state, or network/security controls block it.

A)Validate VM & Guest Agent/Extension Health:

1)VM state: VM must be Running (not Stopped/Deallocated/Updating).

Guest Agent: Ensure Windows Azure VM Guest Agent (Windows) or waagent (Linux) is installed, running, and up‑to‑date.

Windows: services.msc → Windows Azure Guest Agent = Running.

Linux: ps -e | grep waagent.

2)Extensions — In VM → Extensions, all must be Provisioning succeeded. If VMSnapshot is failed, resolve extension state before retrying.

3)VMSnapshot logs : Check on the VM:

4)AV/EDR exclusions:  If you see IaaSBcdrExtension.exe faults, exclude the VMSnapshot plugin folders and retry. B) To Fix Access Denied causes (RBAC, Policy/Locks, Disk access)

The “access denied” class of errors is typically due to RBAC, deny policies/locks, or restricted managed‑disk access during snapshot/export.

1. RBAC: ensure Snapshot operations aren’t blocked: Confirm the identities Azure Backup uses (vault’s managed identity or service principal) have scope to create restore points/snapshots on the VM’s resource group and disks. Contributor is sufficient, Snapshot Contributor may be required for managed disk operations in some environments. After granting, retry backup.

2)Azure Policy / Resource Locks: Check for Deny effect policies or resource locks that target:

• VM’s RG
• the hidden/managed restore point collection RG (often named like AzureBackupRG_<region>_<number>),

disks/snapshots.

If you have tag‑enforcement policies with Deny, switch to Modify or add exemptions for the backup RG, or pre‑create the RG following Azure Backup’s naming guidance. Remove locks that block writes.

3)Managed Disk “private access” / SAS export restrictions: If you use Disk Access to disable public access or require private endpoints, snapshot/export can fail. Align configuration so Backup can temporarily export snapshots (SAS) or ensure private endpoints exist on the DiskAccess resource.

Network prerequisites: Allow outbound to Azure platform IP 168.63.129.16 and Azure Storage/Backup endpoints (80/443, plus extension control channels). Missing ranges in NSG/Firewall can manifest as snapshot/restore point failures.

If the VMSnapshot extension is corrupted or stuck: When health checks pass but the extension remains failed, refresh the VMSnapshot extension

Retry with the right expectations: After fixing permissions/policy/network/extension health, retry Backup Now from the VM or vault. If application‑consistent writers fail, Azure may temporarily take file‑system consistent restore points and then attempt application‑consistent again in subsequent runs.

Thanks,

Suchitra.

Hello Planact IT Admin ,could you please check the comment provided by Suchitra Suregaunkar and let us know if you need any further information.Thank you