Share via

Azure File Restore Failed for Private Access

CobraLin-3015 0 Reputation points
2026-04-02T09:16:53.1366667+00:00

Our environment has public access disabled for the storage account.

Currently, Azure Files Backup is configured. However, during file-level recovery, we are unable to browse or select the files, and the following error is displayed.

We have already enabled private endpoints for both the storage account and the Backup Vault, but the restore operation is still failing.image

Error details

You don't have access

Copy the error details and send them to your administrator(s) to get access to this page.

Azure Backup
Azure Backup

An Azure backup service that provides built-in management at scale.

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Bharath Y P 7,240 Reputation points Microsoft External Staff Moderator
    2026-04-02T10:25:45.1933333+00:00

    Hello cobralin-3015, We understand that you are facing access when doing a file-level restore over private endpoints. Even though you’ve locked down public access and spun up private endpoints on both the storage account and the vault.

    It seems the restore fails because:

    • DNS resolution is not correctly mapping the private endpoint IPs to the required private FQDNs.
    • Without proper DNS, the extension cannot reach the Backup Vault or storage account over private endpoints.
    • Since public access is denied, the fallback path is blocked.
    • This is why browsing during file-level restore fails, even though endpoints exist.

     The restore failure typically occurs because the storage account is accessible only through private endpoints, but DNS resolution is not correctly directing traffic to the private endpoint.

    To resolve this:

    1. Verify DNS Resolution: Run this command nslookup <storageaccount>.file.core.windows.net The result must resolve to the private IP of the storage account private endpoint.
    2. Configure Private DNS Zone : Ensure the following zone exists: privatelink.file.core.windows.net Verify:
      • The zone is linked to the correct VNet
      • A record exists: <storageaccount> > private endpoint IP
    3. Check DNS Configuration: If using custom DNS servers, configure Conditional forwarders or manual DNS records. so the storage endpoint resolves to the private IP.
    4. Firewall Rules: Firewall rules do not apply to private endpoint traffic. They only affect public endpoint access, which is disabled in this scenario.
    5. RBAC Permissions: Ensure the restoring user has Backup Contributor or Backup Operator roles on the Backup Vault.
    6. Fallback Option: If file browsing still fails, restore the entire file share to an alternate location, mount the share, and manually copy the required files.

    Hope this helps. and please feel free to reach out if you have any further questions. Thanks

    Reference document:

    Recover data from an Azure Backup Server by using Azure Backup - Azure Backup | Microsoft Learn

    Create and use private endpoints for Azure Backup - Azure Backup | Microsoft Learn

    Troubleshoot Azure Files backup - Azure Backup | Microsoft Learn

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.