How to fix Error 3220 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 3220 – Backup/Restore to Block Blob Not Supported with WITH CREDENTIAL Syntax

Why This Error Happens

This error occurs because SQL Server 2025 detects that the target URL points to a Block Blob storage container while the backup or restore command explicitly uses the WITH CREDENTIAL syntax. The WITH CREDENTIAL clause is designed for Page Blob storage (used in older striped backup configurations), and Microsoft has deprecated its compatibility with Block Blob endpoints. Essentially, there is a mismatch between the storage blob type configured in Azure and the authentication method specified in the T-SQL command.

Step-by-Step Resolution Guide

Step 1: Verify the Azure Blob Storage Type

  • Log in to the Azure Portal and navigate to your Storage Account.
  • Check the specific container being used for the backup; ensure you note whether it was provisioned as “Block Blob Storage” (most common in modern Azure setups).
  • If the container is confirmed as a Block Blob, you cannot use the legacy CREDENTIAL keyword; proceed to Step 2 to fix the T-SQL syntax.

Step 2: Create a SQL Server Credential Using SAS Tokens

  • Instead of using a standard credential tied to a storage key, generate a Shared Access Signature (SAS) token in the Azure Portal with Read/Write/List/Delete permissions.
  • Open SQL Server Management Studio (SSMS) or Azure Data Studio connected to your instance.
  • Run the following command to create a secret-based credential (replacing the identity name and SAS token):
  CREATE CREDENTIAL [https://<storageaccount>.blob.core.windows.net/<container>]
  WITH IDENTITY = 'SHARED ACCESS SIGNATURE',
  SECRET = '<your_sas_token_without_leading_question_mark>';

Step 3: Modify the Backup Command Syntax

  • Remove the explicit WITH CREDENTIAL = 'credential_name' clause from your BACKUP DATABASE statement if you are relying on the URL-matching credential created in Step 2.
  • Update the script to use the TO URL syntax, which automatically references the matching credential based on the container path:
  BACKUP DATABASE [YourDB] 
  TO URL = 'https://<storageaccount>.blob.core.windows.net/<container>/YourDB.bak'
  WITH COMPRESSION, STATS = 10;
  • Ensure there are no leftover references to CREDENTIAL within the WITH options block for Block Blob paths.

Step 4: Restart the SQL Server Service (If Credential Caching Persists)

  • If the error persists after updating the credential, open Services (services.msc) on Windows Server 2025.
  • Locate SQL Server (MSSQLSERVER) or the specific named instance.
  • Right-click and select Restart to clear any cached authentication tokens associated with the old Page Blob credential.

Alternative or Verification Steps

  • Verification: Run a test backup using BACKUP DATABASE ... TO URL without the CREDENTIAL keyword. If the file appears successfully in the Azure Blob container via Azure Storage Explorer, the fix is confirmed.
  • Alternative: If you specifically require the legacy WITH CREDENTIAL syntax for striping across multiple files, you must provision the Azure container as a Page Blob storage type instead of Block Blob, as Page Blobs remain compatible with the older authentication method.