Function app backups are routinely failing with "Encrypted value padding is invalid"

Question

Function app backups are routinely failing with "Encrypted value padding is invalid"

Cindy 30 Microsoft Employee

All of the attempted backups for my service are failing. The error message is "Encrypted value padding is invalid".

I have attempted to reconfigure the custom backup with a new container and have reset it as needed, but still unable to have a successful backup.

Please refer to the Backups page here: PII

PII

Siddhesh Desai 7,890 Reputation points Microsoft External Staff Moderator

2026-07-27T21:12:04.99+00:00
Hi @Cindy

Thank you for reaching out to Microsoft Q&A.

Please provide the information I have asked in the Private chat? Meanwhile refer below

The error "Encrypted value padding is invalid" during Azure Function App/App Service backups typically indicates that the backup service is unable to decrypt previously stored backup configuration metadata or credentials associated with the custom backup configuration. This issue is commonly seen when the backup configuration contains stale or corrupted encrypted values, such as an invalid storage account key, expired SAS token, or backup configuration data that no longer matches the current encryption context. Reconfiguring the storage container alone may not always clear the underlying encrypted backup metadata, which can cause all subsequent backup attempts to fail with the same error. The error is not currently listed among the standard self-service backup failure scenarios documented for App Service backups and may require deeper investigation if the configuration reset does not resolve it.

Refer below points:

1. Remove and Recreate the Backup Configuration

Navigate to Function App → Backups.

Disable/Delete the existing custom backup configuration completely.

Wait a few minutes and recreate the backup configuration from scratch.

Use a newly generated storage container and, if possible, a different storage account.

2. Validate Storage Account Authentication

Ensure the backup configuration is using a valid Storage Account Access Key or SAS URL.

App Service backups do not support Managed Identity authentication for backup storage.

3. Regenerate Storage Account Keys

If the backup was configured using Account Keys, regenerate the secondary key and update the backup configuration with the new value.

Corrupted or outdated encrypted credentials can trigger decryption failures during backup execution.

4. Review Backup Details

Open the failed backup instance from the Backups blade and review the detailed error information for any additional inner exceptions or storage-related failures.
kagiyama yutaka 4,915 Reputation points

2026-07-27T22:58:55.8433333+00:00

Could you add a bit more detail about your setup. This error often comes from old encrypted backup metadata that didn’t get fully cleared. If you can share any recent app changes and how the backup was set up, that helps.
Cindy 30 Reputation points Microsoft Employee

2026-07-30T18:19:55.6633333+00:00

@kagiyama yutaka Hello, we haven't made any recent app changes. This is a new service that I am ramping up on and so I discovered the backups were failing while exploring the service. I believe that the backups were likely custom configured to run on an hourly schedule a couple years ago and has not been modified since.
Siddhesh Desai 7,890 Reputation points Microsoft External Staff Moderator

2026-08-04T10:18:45.32+00:00

Hi @Cindy

did you get a chance to check my comment above and was it helpful?

Can you send me the details, I have asked in the Private chat?

2 answers

Your answer

kagiyama yutaka 4,915 Reputation points

2026-07-27T22:58:55.8433333+00:00

Could you add a bit more detail about your setup. This error often comes from old encrypted backup metadata that didn’t get fully cleared. If you can share any recent app changes and how the backup was set up, that helps.
Cindy 30 Reputation points Microsoft Employee

2026-07-30T18:19:55.6633333+00:00

@kagiyama yutaka Hello, we haven't made any recent app changes. This is a new service that I am ramping up on and so I discovered the backups were failing while exploring the service. I believe that the backups were likely custom configured to run on an hourly schedule a couple years ago and has not been modified since.
Siddhesh Desai 7,890 Reputation points Microsoft External Staff Moderator

2026-08-04T10:18:45.32+00:00

Hi @Cindy

did you get a chance to check my comment above and was it helpful?

Can you send me the details, I have asked in the Private chat?

Answer 1

kagiyama yutaka 4,915

I think the next step is to open the failed backup entry and read its detail log, and when the error doesn’t match any of the listed causes, sending a support ticket is the next action for Function App backups. This error isn’t in the backup failure list, so the flow ends up being log check and then a ticket.

0 comments

Answer 2

For App Service and Function App custom backups, the supported self-service fixes in the documented error list are:

Reconfigure the backup storage if the failure is storage-access related.
- In the Azure portal, go to the app’s Backups page.
- Select Configure custom backups.
- Choose a storage account in the same subscription and a container.
- Complete Configure, then run Backup Now.
Verify the storage account supports Shared Access Signature (SAS) authorization.
- App Service backup and restore do not support Managed Identity–based authentication to the storage account.
If databases are included, verify the database connection strings.
- Supported databases appear only when their connection strings exist under Configuration > Connection strings.
- If the backup failure is database-related, the documented fixes are to correct the connection string or use an administrative user where required.
Open the failed backup entry to inspect the detailed log.
- On the Backups page, select the failed line item to view the error details.
- If the failure is not one of the documented backup errors, the documented next step is to open a support ticket.

Relevant limits and compatibility checks:

Each backup is a complete copy, not incremental.
Linked databases are backed up only for custom backups.
Custom backups with linked databases support only Single Server tiers of Azure Database for MySQL and PostgreSQL. Flexible Server should use native database backup tools.
If maximum backup size or database size is exceeded, the backup fails.
TLS/SSL-enabled Azure Database for MySQL and PostgreSQL backups are not supported through App Service linked-database backup.

The specific error text "Encrypted value padding is invalid" is not listed in the documented App Service backup error table. Since reconfiguring the container has already been tried, the supported next action is to select a failed backup entry for full log details and, if the error still isn’t covered by the documented errors, open a support ticket.

References:

Back up and restore your app in Azure App Service

Function app backups are routinely failing with "Encrypted value padding is invalid"

Hi @Cindy

2 answers

Your answer