How to fix Error 3289 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 3289 – “A Backup Device of Type URL Was Specified Without a Credential”

Why This Error Happens

This error occurs when SQL Server 2025 attempts to perform a BACKUP or RESTORE operation to/from Azure Blob Storage (URL device) without an associated SQL Server Credential object. SQL Server requires an explicit Credential mapped to the storage container URL to authenticate the request, since URL-based backups do not use Windows Authentication or integrated security. This typically happens when the credential was never created, was deleted, or does not match the exact container path referenced in the BACKUP DATABASE ... TO URL command.

Step-by-Step Resolution Guide

Step 1: Verify the Storage Account and Access Key/SAS Token

  • Log in to the Azure Portal and navigate to your Storage Account.
  • Under Security + networking > Access keys, copy the Key or generate a new Shared Access Signature (SAS) token with Read/Write/List/Delete permissions.
  • Confirm the container name matches exactly what will be referenced in the backup URL (e.g., https://<account>.blob.core.windows.net/<container>).

Step 2: Create a SQL Server Credential

  • Open SQL Server Management Studio (SSMS) and connect to your SQL Server 2025 instance.
  • Run the following T-SQL script, replacing values as needed:
CREATE CREDENTIAL [https://<account>.blob.core.windows.net/<container>]
WITH IDENTITY = 'SHARED ACCESS SIGNATURE',
SECRET = '<SAS_Token_Without_Leading_?>';
  • Note: The IDENTITY name must be exactly SHARED ACCESS SIGNATURE when using SAS tokens; for Storage Account Keys, use IDENTITY = '<storage_account_name>'.

Step 3: Match the Credential Name to the Backup URL Path

  • Ensure the Credential name (the URL path) is identical, character-for-character, to the path used in your backup command.
  • Run a test backup:
BACKUP DATABASE [YourDatabase]
TO URL = 'https://<account>.blob.core.windows.net/<container>/YourDatabase.bak'
WITH COMPRESSION, STATS = 10;
  • Check for typos in the container name, trailing slashes, or protocol mismatches (http vs https).

Step 4: Validate Permissions on the SQL Server Service Account

  • Confirm the SQL Server service account (running under Windows Server 2025) has outbound internet/firewall access to *.blob.core.windows.net on port 443.
  • If using a proxy or restrictive firewall, whitelist the Azure Storage endpoint.

Step 5: Refresh Expired Credentials

  • If the SAS token has expired, regenerate it in Azure and update the credential using ALTER CREDENTIAL instead of creating a duplicate:
ALTER CREDENTIAL [https://<account>.blob.core.windows.net/<container>]
WITH IDENTITY = 'SHARED ACCESS SIGNATURE',
SECRET = '<New_SAS_Token>';

Alternative or Verification Steps

  • Run SELECT * FROM sys.credentials; in SSMS to confirm the credential exists and the name exactly matches your backup URL.
  • If the error persists, test connectivity independently using Azure Storage Explorer with the same SAS token/key to rule out network or permission issues outside of SQL Server.