How to fix Error 3259 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 3259 – “Failed to copy blob with name ‘%ls'”

Why This Error Happens

Error 3259 typically occurs during a SQL Server BACKUP or RESTORE operation targeting a URL (Azure Blob Storage) when the backup process cannot successfully write or read the blob file. This is most commonly caused by invalid or expired Shared Access Signature (SAS) credentials, network interruptions between the SQL Server instance and the storage endpoint, or insufficient permissions on the storage container. Corrupted credential objects within SQL Server or a mismatch in the blob storage access tier can also trigger this failure.

Step-by-Step Resolution Guide

Step 1: Verify the SQL Server Credential and SAS Token

  • Open SQL Server Management Studio (SSMS) and run SELECT * FROM sys.credentials; to confirm the credential tied to your storage account URL exists.
  • Check the expiration date of the SAS token used to create the credential; expired tokens are the leading cause of Error 3259.
  • If expired, generate a new SAS token from the Azure Portal under Storage Account > Shared Access Signature, then recreate the credential:
CREATE CREDENTIAL [https://<account>.blob.core.windows.net/<container>]
WITH IDENTITY = 'SHARED ACCESS SIGNATURE',
SECRET = '<new_sas_token>';

Step 2: Test Network Connectivity to the Storage Endpoint

  • On Windows Server 2025 or Windows 11, open PowerShell and run Test-NetConnection <account>.blob.core.windows.net -Port 443 to confirm outbound HTTPS access.
  • Check Windows Firewall rules under Control Panel > Windows Defender Firewall > Advanced Settings to ensure outbound traffic on port 443 is not blocked.
  • If using a proxy, verify the SQL Server service account has proxy credentials configured in machine.config or via system-wide proxy settings.

Step 3: Validate Blob Container Permissions and Access Tier

  • In the Azure Portal, navigate to Storage Account > Containers and confirm the target container exists and is not set to “Archive” tier (archived blobs cannot be written to directly).
  • Confirm the SAS token permissions include Read, Write, List, and Create at minimum.
  • Regenerate the SAS token with correct permissions if any are missing, then update the SQL Server credential as shown in Step 1.

Step 4: Restart SQL Server Services and Retry the Operation

  • Open Services.msc on Windows Server 2025, locate “SQL Server (MSSQLSERVER)”, and restart the service to clear any cached connection states.
  • Re-run the BACKUP or RESTORE command:
BACKUP DATABASE [YourDB]
TO URL = 'https://<account>.blob.core.windows.net/<container>/YourDB.bak'
WITH CREDENTIAL = '<credential_name>', STATS = 10;
  • Monitor the SQL Server Error Log (SSMS > Management > SQL Server Logs) for confirmation of successful completion.

Alternative or Verification Steps

  • Verify success by checking the Azure Storage container directly via Azure Storage Explorer to confirm the blob file was created with the expected size and timestamp.
  • If the issue persists, switch to a Managed Identity or Storage Account Key authentication method instead of SAS tokens, as token-based credentials are more prone to silent expiration issues.