Unable to re-register Workload in Azure VM (SQL server on VM) even with existing private endpoint between VM and RSV.

Question

Unable to re-register Workload in Azure VM (SQL server on VM) even with existing private endpoint between VM and RSV.

Grzegorz Koperczak 0

Error visible:

Workload Backup extension on the virtual machine is not able to contact Azure Backup service due to network connectivity issues.Connection timeouts can be transient, use the re-register option available in the Backup Infrastructure pane in the vault to re-register the virtual machine with Azure backup service and then retry the operation. Ensure that TLS 1.2 is not blocked. Follow the steps mentioned at https://go.microsoft.com/fwlink/?linkid=2091800 to self-diagnose the network issues. If the issue persists, please contact Microsoft support
There is existing private endpoint created for RSV (same vnet as Azure VM)

Bharath Y P 2,805 Reputation points Microsoft External Staff Moderator

2025-12-11T21:15:17.4733333+00:00
Hello Grzegorz Koperczak,

We understand that you're facing issues with the Azure Backup extension on your SQL Server VM not being able to connect to the Azure Backup service, despite having a private endpoint set up.

If the SQL VM needs to be registered in the new vault, then it must be unregistered from the old vault. Unregistration of a SQL VM from the vault requires all the protected data sources to be stop protected and then you can delete the backed-up data. Deleting backed up data is a destructive operation. After you've reviewed and taken all the precautions to unregister the SQL VM, then register this same VM with a new vault and retry the backup operation.

Troubleshoot SQL Server database backup - Azure Backup | Microsoft Learn

Check for Existing Registrations: Make sure the VM isn't already registered. You can check this using the Azure CLI:
az backup container list --backup-management-type AzureWorkload --resource-group <resource-group-name> --vault-name <vault-name>

Unregister the VM: If you find the VM in the list, you'll want to unregister it:
az backup container unregister --resource-group <resource-group-name> --vault-name <vault-name> --container-name <container-name>

Register the VM Again: After unregistering, try registering it again:
az backup container register --resource-group <resource-group-name> --vault-name <vault-name> --workload-type MSSQL --backup-management-type AzureWorkload -- resource-id <resource-id>

Verify the Current TLS Settings:

Run this in PowerShell:

[Net.ServicePointManager]::SecurityProtocol,

If the output does not include Tls12, it means TLS 1.2 is not currently enabled. enable it by running:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Validate Network Connectivity:

Ensure that your VM can reach Azure Backup service endpoints by testing the connection:

Test-NetConnection -ComputerName [Azure Backup Service URL] -Port 443

Confirm that your firewall or Network Security Group (NSG) rules allow outbound traffic on port 443 (HTTPS).

Private DNS zone linkage

Make sure you’ve created and linked the private DNS zone for privatelink.backup.windowsazure.com to your VNet.

Without this, the VM may resolve the vault name to a public IP instead of the private endpoint, causing timeouts.

Outbound service tags

Even with a private endpoint, the VM must reach AzureBackup, AzureActiveDirectory, and Storage service tags over port 443.

NSGs or firewalls should allow outbound traffic to these tags. The private endpoint only secures vault traffic, not all backup service calls.

I hope this information helps. Please do let us know if you have any further queries. Thanks
Bharath Y P 2,805 Reputation points Microsoft External Staff Moderator

2025-12-12T22:47:51.69+00:00

Hello Grzegorz Koperczak, I just wanted to kindly follow up to check if you had a chance to review my earlier response. I hope the information shared was helpful. Please feel free to reach out if you have any additional questions or need further clarification. If the answer addressed your query, it would be great if you could accept it and up-vote. This not only helps us but also makes it easier for other community members who might face the same issue. Thanks

Grzegorz Koperczak 0

I have run connectivity test script to confirm everything was opened.

[2025-12-12 21:49:14] Service urls for connectivity tests
[2025-12-12 21:49:14] 
Name                           Value                                                                                   
----                           -----                                                                                   
Fabric                         https://pod01-fab1.plc.backup.windowsazure.com/resources/<resource>/containers/<container>/ChannelEncryptionKeys
WLBCM                          https://pod01-wbcm1.plc.backup.windowsazure.com/resources/<resource>/containers/<container>/ChannelEncryptionKeys

[2025-12-12 21:49:15] =============Trying TLS Tls12===================
[2025-12-12 21:49:15] Fabric Call successful
[2025-12-12 21:49:15] WLBCM Call successful
[2025-12-12 21:49:15] Service call test summary
[2025-12-12 21:49:15] 
Name   TLS                                                                                  TLS11                      
----   ---                                                                                  -----                                                                                                                                             
Fabric Połączenie podstawowe zostało zakończone: Wystąpił nieoczekiwany błąd przy odbiorze. Połączenie podstawowe zo...
WLBCM  Połączenie podstawowe zostało zakończone: Wystąpił nieoczekiwany błąd przy odbiorze. Połączenie podstawowe zo...

[2025-12-12 21:49:15] =============Trying TLS Tls12===================
[2025-12-12 21:49:15] Storage Call successful
[2025-12-12 21:49:15] Storage call test summary
TLS TLS11 TLS12
--- ----- -----
Red Red   Green

When doing Test-NetConnection -ComputerName pod01-wbcm1.plc.backup.windowsazure.com -Port 443

ComputerName : pod01-wbcm1.plc.backup.windowsazure.com

RemoteAddress : 20.215.4.37

RemotePort : 443

InterfaceAlias : Ethernet

SourceAddress : <private-ip>

TcpTestSucceeded : True

Even that i have added whatever was missing in firewall or nsg to allow traffic.

[Net.ServicePointManager]::SecurityProtocol returned SystemDefault, so i have set this also as per recommendation.

Still issue visible.

Bharath Y P 2,805 Reputation points Microsoft External Staff Moderator

2025-12-16T01:03:59.2733333+00:00
Hello Grzegorz Koperczak, Thanks for the update. If the error still persists could you please check the below points.

Private DNS Zone Resolution

Make sure the VM resolves the vault FQDN to the private endpoint IP.

Run nslookup <vaultname>.privatelink.backup.windowsazure.com from inside the VM.

If it resolves to a public IP, the private DNS zone isn’t linked correctly to the VNet.

Multiple Vault Registrations

A SQL VM can only be registered to one vault at a time.
az backup container list --backup-management-type AzureWorkload \ --resource-group <rg> --vault-name <vault>
If the VM is still registered in an old vault, unregister it before registering with the new one.

Logs for Detail:

VM logs are under: C:\ProgramData\Microsoft Azure\AzureBackup

Look for CBEngineCurr.errlog or WABCDebug.log to see if DNS resolution or TLS negotiation is failing.

Thanks

1 answer

Your answer

Bharath Y P 2,805 Reputation points Microsoft External Staff Moderator

2025-12-12T22:47:51.69+00:00

Hello Grzegorz Koperczak, I just wanted to kindly follow up to check if you had a chance to review my earlier response. I hope the information shared was helpful. Please feel free to reach out if you have any additional questions or need further clarification. If the answer addressed your query, it would be great if you could accept it and up-vote. This not only helps us but also makes it easier for other community members who might face the same issue. Thanks
Grzegorz Koperczak 0 Reputation points

2025-12-13T06:51:54.2866667+00:00

I have run connectivity test script to confirm everything was opened.

[2025-12-12 21:49:14] Service urls for connectivity tests [2025-12-12 21:49:14] Name Value ---- ----- Fabric https://pod01-fab1.plc.backup.windowsazure.com/resources/<resource>/containers/<container>/ChannelEncryptionKeys WLBCM https://pod01-wbcm1.plc.backup.windowsazure.com/resources/<resource>/containers/<container>/ChannelEncryptionKeys [2025-12-12 21:49:15] =============Trying TLS Tls12=================== [2025-12-12 21:49:15] Fabric Call successful [2025-12-12 21:49:15] WLBCM Call successful [2025-12-12 21:49:15] Service call test summary [2025-12-12 21:49:15] Name TLS TLS11 ---- --- ----- Fabric Połączenie podstawowe zostało zakończone: Wystąpił nieoczekiwany błąd przy odbiorze. Połączenie podstawowe zo... WLBCM Połączenie podstawowe zostało zakończone: Wystąpił nieoczekiwany błąd przy odbiorze. Połączenie podstawowe zo... [2025-12-12 21:49:15] =============Trying TLS Tls12=================== [2025-12-12 21:49:15] Storage Call successful [2025-12-12 21:49:15] Storage call test summary TLS TLS11 TLS12 --- ----- ----- Red Red Green

When doing Test-NetConnection -ComputerName pod01-wbcm1.plc.backup.windowsazure.com -Port 443

ComputerName : pod01-wbcm1.plc.backup.windowsazure.com

RemoteAddress : 20.215.4.37

RemotePort : 443

InterfaceAlias : Ethernet

SourceAddress : <private-ip>

TcpTestSucceeded : True

Even that i have added whatever was missing in firewall or nsg to allow traffic.

[Net.ServicePointManager]::SecurityProtocol returned SystemDefault, so i have set this also as per recommendation.

Still issue visible.
Bharath Y P 2,805 Reputation points Microsoft External Staff Moderator

2025-12-16T01:03:59.2733333+00:00

Hello Grzegorz Koperczak, Thanks for the update. If the error still persists could you please check the below points.

Private DNS Zone Resolution

Make sure the VM resolves the vault FQDN to the private endpoint IP.

Run nslookup <vaultname>.privatelink.backup.windowsazure.com from inside the VM.

If it resolves to a public IP, the private DNS zone isn’t linked correctly to the VNet.

Multiple Vault Registrations

A SQL VM can only be registered to one vault at a time.
az backup container list --backup-management-type AzureWorkload \ --resource-group <rg> --vault-name <vault>
If the VM is still registered in an old vault, unregister it before registering with the new one.

Logs for Detail:

VM logs are under: C:\ProgramData\Microsoft Azure\AzureBackup

Look for CBEngineCurr.errlog or WABCDebug.log to see if DNS resolution or TLS negotiation is failing.

Thanks

Answer 1

If you are unable to re-register the Workload Backup extension on your Azure VM due to network connectivity issues, here are some steps you can take:

Check Network Connectivity: Ensure that the Azure VM can reach the Azure Backup service. This includes verifying that there are no network security group (NSG) rules or firewall settings blocking the connection.
TLS 1.2 Compliance: Make sure that TLS 1.2 is not blocked on your network as it is required for secure communication with Azure services.
Use Re-register Option: As suggested in the error message, use the re-register option available in the Backup Infrastructure pane in the Recovery Services vault. This can help re-establish the connection between the VM and the Azure Backup service.
Self-Diagnose Network Issues: Follow the self-diagnosis steps mentioned in the Azure documentation to identify any underlying network issues. This may provide insights into what might be causing the connectivity problems.
Contact Support: If the issue persists after trying the above steps, consider reaching out to Microsoft support for further assistance.

Since you mentioned that there is an existing private endpoint created for the Recovery Services vault (RSV) in the same virtual network as the Azure VM, ensure that the private endpoint is correctly configured and that the DNS settings are properly set up to resolve the Azure Backup service endpoint.

References:

Share via

Unable to re-register Workload in Azure VM (SQL server on VM) even with existing private endpoint between VM and RSV.

1 answer

Your answer