How to fix Error 3225 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 3225 – Invalid WITH CREDENTIAL Syntax for SAS Tokens

Why This Error Happens

This error occurs when a BACKUP or RESTORE statement references a credential containing a Shared Access Signature (SAS) token using the legacy WITH CREDENTIAL syntax. SQL Server 2025, like prior versions, requires SAS-based credentials to be invoked using the WITH SAS CREDENTIAL clause instead, since SAS tokens are structurally and authentication-wise different from standard storage account key credentials. The engine throws Error 3225 as a hard syntax validation check to prevent malformed authentication requests from being sent to Azure Blob Storage.

Step-by-Step Resolution Guide

Step 1: Verify the Credential Type Stored in SQL Server

  • Run SELECT name, credential_identity FROM sys.credentials; to confirm the credential is tied to a SAS token (identity will typically show SHARED ACCESS SIGNATURE).
  • Confirm the credential was created using IDENTITY = 'SHARED ACCESS SIGNATURE' and not IDENTITY = '<storage_account_name>'.
  • Cross-check the Azure Storage Account to ensure the SAS token hasn’t expired or been regenerated.

Step 2: Correct the T-SQL Syntax in Your Backup/Restore Script

  • Replace WITH CREDENTIAL = 'MyCredential' with WITH SAS CREDENTIAL = 'MyCredential'.
  • Example corrected syntax:
  RESTORE DATABASE [MyDB]
  FROM URL = 'https://mystorageaccount.blob.core.windows.net/backups/mydb.bak'
  WITH SAS CREDENTIAL = 'MyCredential', REPLACE;
  • Ensure there are no leftover script templates or automation jobs (SQL Agent, Maintenance Plans) still using the deprecated syntax.

Step 3: Recreate the Credential if Necessary

  • If the credential was originally created incorrectly, drop and recreate it:
  DROP CREDENTIAL [MyCredential];
  CREATE CREDENTIAL [MyCredential]
  WITH IDENTITY = 'SHARED ACCESS SIGNATURE',
  SECRET = '<your-sas-token-without-leading-question-mark>';
  • Confirm the SAS token string does not include a leading ? character, as this is a common cause of authentication failures even after syntax is corrected.

Step 4: Update Automation Scripts and Maintenance Plans

  • Search SQL Agent Job steps (via SSMS > SQL Server Agent > Jobs) for any hardcoded WITH CREDENTIAL references.
  • Update PowerShell/DevOps pipeline scripts (.ps1, .sql files stored on Windows Server 2025 file paths such as C:\SQLScripts\Backups\) to reflect the SAS CREDENTIAL keyword.
  • Redeploy updated scripts to any scheduled tasks or Azure Automation runbooks triggering these backups.

Alternative or Verification Steps

  • Re-run the BACKUP or RESTORE command manually in SSMS after applying the WITH SAS CREDENTIAL fix and confirm no Error 3225 is returned.
  • If the error persists, validate that the SQL Server 2025 instance has the latest Cumulative Update installed, as older builds may have incomplete SAS credential parsing support.