How to fix Error 3298 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 3298 — Backup/Restore to URL Device Error

Why This Error Happens

Error 3298 occurs when SQL Server 2025 fails to communicate with the Azure Blob Storage (or other URL-based) device during a BACKUP or RESTORE operation. This is typically caused by an expired or malformed Shared Access Signature (SAS) token, an incorrectly configured SQL Credential tied to the storage account, or network-level blocking (firewall/proxy) preventing outbound HTTPS traffic to the blob endpoint. It can also result from a mismatch between the container access policy and the permissions granted to the credential.

Step-by-Step Resolution Guide

Step 1: Validate the SQL Credential and SAS Token

  • Open SQL Server Management Studio (SSMS) and run SELECT * FROM sys.credentials WHERE name LIKE '%url%'; to locate the credential used for the URL backup device.
  • Confirm the SAS token embedded in the credential’s secret has not expired by checking the se= (expiry) parameter in the token string.
  • If expired, regenerate a new SAS token from the Azure Portal under Storage Account > Shared Access Signature, ensuring Read, Write, List, Delete, Create permissions are checked.
  • Recreate the credential using:
  CREATE CREDENTIAL [https://yourstorageaccount.blob.core.windows.net/yourcontainer]
  WITH IDENTITY = 'SHARED ACCESS SIGNATURE',
  SECRET = 'sv=2025-01-01&ss=b&srt=sco&sp=rwdlac...';

Step 2: Verify Network Connectivity to the Blob Endpoint

  • From the Windows Server 2025 / Windows 11 host, test connectivity using PowerShell:
  Test-NetConnection yourstorageaccount.blob.core.windows.net -Port 443
  • Ensure no corporate firewall, proxy, or NSG (Network Security Group) rule is blocking outbound traffic on port 443.
  • If using a proxy, confirm the SQL Server service account has the correct proxy settings configured in netsh winhttp show proxy.

Step 3: Check Storage Account Firewall and Container Policy

  • In the Azure Portal, navigate to Storage Account > Networking and confirm “Allow access from” includes the public IP of your Windows Server 2025 instance (or is set to “All networks” for testing).
  • Verify the target container exists and matches the exact path referenced in the TO URL clause of your backup command (case-sensitive).
  • Confirm the container’s access level isn’t set to “Private” in a way that conflicts with SAS-based access (SAS should override this, but double-check for conflicting Azure RBAC policies).

Step 4: Re-run the Backup/Restore Command with Verbose Logging

  • Execute the command with WITH STATS = 10 to capture progress and isolate where the failure occurs:
  BACKUP DATABASE [YourDB]
  TO URL = 'https://yourstorageaccount.blob.core.windows.net/yourcontainer/YourDB.bak'
  WITH CREDENTIAL = 'https://yourstorageaccount.blob.core.windows.net/yourcontainer', STATS = 10;
  • Review the SQL Server Error Log (Management > SQL Server Logs in SSMS) immediately after failure for the expanded %.*ls message detail, which usually contains the underlying HTTP status code (e.g., 403 Forbidden, 404 Not Found).

Alternative or Verification Steps

  • Verify the fix: Successfully run a small test backup (e.g., a system database like tempdb) to the same URL target; if it completes without Error 3298, the credential and connectivity are confirmed healthy.
  • Alternative workaround: If Azure Blob access remains unstable, temporarily switch to a local disk or SMB file share backup target (TO DISK = '\\fileserver\backups\') while investigating the storage account’s access policies further.