NetWorker: Azure VM Restore Fails "Response Code: 403. This request is not authorized to perform this operation"

Summary: NetWorker Azure Virtual Machine (VM) restore (nsrazure_recover) fails with the error "Response Code: 403 Response Data: AuthorizationFailure This request is not authorized to perform this operation." ...

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

NetWorker is configured to perform Azure VM Snapshot Protection.
An Azure VM snapshot restore immediately fails with the following error in the nsrazure_recover log:

Linux: /nsr/logs/adhoc/nsrazure_recover/jobid.log
Windows (Default): C:\Program Files\EMC NetWorker\nsr\logs\adhoc\nsrazure_recover\jobid.log

Using 'VNET-NAME' vnet from resource group 'RESOURCE-GROUP-NAME'.
Target VM 'RESOURCE-GROUP-NAME:VM-NAME' does not exist and will be recreated.
Restoring OS disk 'VM-NAME_OsDisk_1'.
Using 'STORAGE-ACCOUNT-NAME' storage account from resource group 'RESOURCE-GROUP-NAME'.
208119:nsrazure_recover: Error from url 'https://STORAGE-ACCOUNT-NAME.blob.core.windows.net/nw-localhost-recovery-container/VM-NAME_OsDisk_1?sv=2015-04-05&ss=bf&srt=sco&sp=rwdl&se=2025-07-16T15%3A09%3A17.0000000Z&sig=UWDnIOofoiYihS6xaCkgtvm%2FlNRp%2FCzZVeUrf%2BN9Ewg%3D': Response Code: 403 Response Data: <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationFailure</Code><Message>This request is not authorized to perform this operation.
RequestId:REQUEST-ID
Time:YYYY-MM-DDTHH:mm:SS</Message></Error>
207849:nsrazure_recover: Failed createEmptyBlob...
207851:nsrazure_recover: azurevmrecover: error while creating disk
207541:nsrazure_recover: Unable to start recover session for subscription 'SUBSCRIPTION-RESOURCE-NAME', resource group 'RESOURCE-GROUP-NAME', storage account 'STORAGE-ACCOUNT-NAME'

The NWBackupAdminRole has been created with all the required permissions and assigned to the Azure subscription. See the Azure authentication process section of the NetWorker Azure VM Snapshot Integration Guide: https://www.dell.com/support/product-details/product/networker/docs  

Cause

This authorization failure can still occur even with correct permissions. It happens when the Azure storage account lacks a configured private endpoint connection.

Storage account endpoint

NOTE: An Azure Storage Account Private Endpoint connection is used to securely connect resources within your virtual network (VNET) to an Azure Storage account over the Microsoft network, rather than the public Internet. In the context of restoring an Azure VM, this plays a crucial role in enhancing security and ensuring private connectivity during the restore process.

Resolution

There are two options:

  • If the specified storage account must be used, the Azure Administrator must configure a Private endpoint connection for the Azure storage account.
  • The NetWorker backup administrator can specify a different Azure storage account during the restore. The storage account must be in the same target Azure region as the target disk, and must have a private endpoint connection configured.

Additional Information

If the storage account specified during the restore is in a different Azure region than the target disk, the restore fails: NetWorker: Azure VM Snapshot restore fails "the source blob does not belong to the same region as the disk"

Affected Products

NetWorker

Products

NetWorker Family
Article Properties
Article Number: 000345809
Article Type: Solution
Last Modified: 16 Jul 2025
Version:  1
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.