How to fix Error 13131 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 13131 (Credential Issue)

Why This Error Happens

Error 13131 in Microsoft SQL Server 2025 typically occurs when a database-scoped or server-level credential references authentication information that cannot be validated by the underlying operating system or external identity provider. This is most commonly caused by an expired, malformed, or mismatched secret (such as a SAS token, managed identity key, or Windows credential) stored in the credential object. It can also result from insufficient permissions on the credential’s associated identity when SQL Server attempts to use it for operations like BACKUP TO URL, CREATE EXTERNAL DATA SOURCE, or PolyBase authentication against Windows Server 2025 / Windows 11 security subsystems.

Step-by-Step Resolution Guide

Step 1: Verify the Credential Object Exists and Is Correctly Scoped

  • Run SELECT name, credential_identity, create_date FROM sys.credentials; to confirm the credential is present at the server level.
  • For database-scoped credentials, run SELECT name, credential_identity FROM sys.database_scoped_credentials; inside the relevant database context.
  • Confirm the credential_identity matches exactly what the external service (Azure Storage, Windows Credential Manager, etc.) expects — case sensitivity and trailing spaces matter.

Step 2: Recreate the Credential with Updated Secret

  • Drop the broken credential: DROP CREDENTIAL [CredentialName];
  • Recreate it with a fresh secret or token:
CREATE CREDENTIAL [CredentialName]
WITH IDENTITY = 'SHARED ACCESS SIGNATURE',
SECRET = '<new-valid-SAS-token>';
  • If using Windows Authentication-based credentials, ensure the identity string follows the DOMAIN\Username format exactly and the password hasn’t expired in Active Directory.

Step 3: Check Windows Credential Manager and Service Account Permissions

  • Open Control Panel > Credential Manager on Windows Server 2025 / Windows 11 and verify no conflicting or expired Windows Credentials exist under “Windows Credentials.”
  • Confirm the SQL Server service account has Log on as a service rights via secpol.msc > Local Policies > User Rights Assignment.
  • Restart the SQL Server service (services.msc > SQL Server (MSSQLSERVER) > Restart) after any credential or permission change to force re-authentication.

Step 4: Validate External Resource Access (If Using Cloud Storage or PolyBase)

  • Test connectivity independently using Azure Storage Explorer or azcopy with the same SAS token/key to confirm it’s not an external-side expiration issue.
  • Check firewall rules on Windows Server 2025 to ensure outbound HTTPS (443) traffic isn’t being blocked, which can trigger a false credential validation failure.
  • Review ERRORLOG via EXEC xp_readerrorlog 0, 1, N'13131'; for additional context on which specific credential operation failed.

Alternative or Verification Steps

  • Verify the fix: Re-run the original operation (backup, restore, or external table query) that triggered Error 13131, and confirm no error is raised; also check sys.dm_server_registry or Extended Events for successful authentication logging.
  • Alternative fix: If the credential continues to fail, switch authentication method entirely — for example, move from SAS token-based credentials to Managed Identity (if running on Azure-connected infrastructure) or use a dedicated Active Directory service account with explicit ALTER ANY CREDENTIAL permission granted via GRANT ALTER ANY CREDENTIAL TO [UserName];.