How to fix Error 3290 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 3290 — Backup to URL Exception

Why This Error Happens

Error 3290 occurs when SQL Server 2025 attempts to write a backup file directly to a URL endpoint (Azure Blob Storage or S3-compatible storage) but receives an exception from the remote storage endpoint rather than a successful acknowledgment. This is typically caused by invalid or expired Shared Access Signature (SAS) credentials, incorrect container permissions, network/firewall restrictions blocking outbound HTTPS traffic to the storage endpoint, or the target container/bucket not existing. In some cases, the underlying storage account itself may be throttling requests or experiencing a transient outage, which SQL Server surfaces as a generic remote exception.

Step-by-Step Resolution Guide

Step 1: Validate the Credential or SAS Token

  • Open SQL Server Management Studio (SSMS) and run SELECT * FROM sys.credentials; to confirm the credential used for the backup still exists and matches the storage account name.
  • Check the SAS token expiration date — tokens issued via Azure Portal or az storage container generate-sas often expire silently.
  • Regenerate the credential using:
  CREATE CREDENTIAL [https://<account>.blob.core.windows.net/<container>]
  WITH IDENTITY = 'SHARED ACCESS SIGNATURE',
  SECRET = '<new_sas_token>';

Step 2: Verify Container Existence and Permissions

  • Confirm the target container (e.g., sqlbackups) exists in the storage account; SQL Server will not auto-create containers.
  • In Azure Portal, check the SAS token permissions include Read, Write, List, Create, and Delete on the container/service scope.
  • If using S3-compatible storage, confirm the bucket policy allows PutObject and ListBucket for the IAM credentials in use.

Step 3: Check Network and Firewall Connectivity

  • From the Windows Server 2025 / Windows 11 host, test outbound connectivity:
  Test-NetConnection <account>.blob.core.windows.net -Port 443
  • Ensure no corporate proxy, NSG rule, or Windows Defender Firewall rule is blocking port 443 outbound.
  • If a proxy is required, confirm SQL Server service account has proxy settings configured via netsh winhttp show proxy and update if necessary.

Step 4: Review SQL Server Error Log for the Full Exception Text

  • Open SQL Server Error Log (via SSMS → Management → SQL Server Logs) and locate the full %.*ls expanded message tied to Error 3290.
  • The expanded text usually reveals the actual HTTP status code (e.g., 403 Forbidden, 404 Not Found) from the storage endpoint — use this to pinpoint whether it’s an auth, path, or throttling issue.

Step 5: Retry the Backup with Compression and Smaller Block Size

  • If the error correlates with large backup files timing out, retry using:
  BACKUP DATABASE [YourDB]
  TO URL = 'https://<account>.blob.core.windows.net/sqlbackups/yourdb.bak'
  WITH COMPRESSION, MAXTRANSFERSIZE = 4194304, BLOCKSIZE = 65536;
  • Smaller block/transfer sizes reduce the chance of intermittent remote endpoint timeouts.

Alternative or Verification Steps

  • Run a manual test backup to the same URL immediately after updating credentials — a successful completion with 100 percent processed confirms the fix.
  • As an alternative, test connectivity and permissions independently using AzCopy or Azure Storage Explorer with the same credentials to isolate whether the issue is SQL Server-specific or a genuine storage/network problem.