Azure File Restore Failed for Private Access

Question

Azure File Restore Failed for Private Access

CobraLin-3015 0

Our environment has public access disabled for the storage account.

Currently, Azure Files Backup is configured. However, during file-level recovery, we are unable to browse or select the files, and the following error is displayed.

We have already enabled private endpoints for both the storage account and the Backup Vault, but the restore operation is still failing.

Error details

You don't have access

Copy the error details and send them to your administrator(s) to get access to this page.

Bharath Y P 7,080 Reputation points Microsoft External Staff Moderator

2026-04-02T09:49:17.6733333+00:00

Hello cobralin-3015, Thank you for posting your query on Microsoft Q&A platform.

We are looking into your issue and will keep you posted updates.

Thanks,
Bharath Y P 7,080 Reputation points Microsoft External Staff Moderator

2026-04-02T10:25:45.1933333+00:00
Hello cobralin-3015, We understand that you are facing access when doing a file-level restore over private endpoints. Even though you’ve locked down public access and spun up private endpoints on both the storage account and the vault.

It seems the restore fails because:

DNS resolution is not correctly mapping the private endpoint IPs to the required private FQDNs.

Without proper DNS, the extension cannot reach the Backup Vault or storage account over private endpoints.

Since public access is denied, the fallback path is blocked.

This is why browsing during file-level restore fails, even though endpoints exist.

The restore failure typically occurs because the storage account is accessible only through private endpoints, but DNS resolution is not correctly directing traffic to the private endpoint.

To resolve this:

Verify DNS Resolution: Run this command nslookup <storageaccount>.file.core.windows.net The result must resolve to the private IP of the storage account private endpoint.

Configure Private DNS Zone : Ensure the following zone exists: privatelink.file.core.windows.net Verify:

The zone is linked to the correct VNet

A record exists: <storageaccount> > private endpoint IP

Check DNS Configuration: If using custom DNS servers, configure Conditional forwarders or manual DNS records. so the storage endpoint resolves to the private IP.

Firewall Rules: Firewall rules do not apply to private endpoint traffic. They only affect public endpoint access, which is disabled in this scenario.

RBAC Permissions: Ensure the restoring user has Backup Contributor or Backup Operator roles on the Backup Vault.

Fallback Option: If file browsing still fails, restore the entire file share to an alternate location, mount the share, and manually copy the required files.

Hope this helps. and please feel free to reach out if you have any further questions. Thanks

Reference document:

Recover data from an Azure Backup Server by using Azure Backup - Azure Backup | Microsoft Learn

Create and use private endpoints for Azure Backup - Azure Backup | Microsoft Learn

Troubleshoot Azure Files backup - Azure Backup | Microsoft Learn