How to fix Error 3291 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 3291 — “URL Device Type Was Specified”

Why This Error Happens

Error 3291 occurs when a BACKUP or RESTORE statement specifies a URL device type (used for backing up to Azure Blob Storage) but the syntax, credential, or endpoint configuration doesn’t meet the requirements SQL Server expects for that device type. This typically stems from a missing or misconfigured SQL Server CREDENTIAL object, an invalid or malformed URL path, or the absence of a corresponding SAS token/storage account key needed to authenticate against the Blob container. It can also occur if the backup command mixes incompatible device types (e.g., combining DISK and URL in the same statement) or if the storage endpoint is unreachable due to networking/firewall restrictions.

Step-by-Step Resolution Guide

Step 1: Validate the BACKUP/RESTORE Syntax

  • Ensure the command uses TO URL = 'https://<storageaccount>.blob.core.windows.net/<container>/<filename>.bak' with no trailing slashes or extra parameters.
  • Confirm you are not mixing DISK = and URL = in the same backup statement — SQL Server 2025 requires device type consistency.
  • Example correct syntax:
  BACKUP DATABASE [YourDB]
  TO URL = 'https://mystorageacct.blob.core.windows.net/sqlbackups/YourDB.bak'
  WITH CREDENTIAL = 'AzureBlobCredential', COMPRESSION;

Step 2: Recreate or Verify the SQL Server Credential

  • Open SSMS and run:
  SELECT * FROM sys.credentials WHERE name = 'AzureBlobCredential';
  • If missing or outdated, recreate it using a valid Shared Access Signature (SAS) token:
  CREATE CREDENTIAL [https://mystorageacct.blob.core.windows.net/sqlbackups]
  WITH IDENTITY = 'SHARED ACCESS SIGNATURE',
  SECRET = '<SAS_TOKEN_WITHOUT_LEADING_QUESTION_MARK>';
  • Ensure the credential name exactly matches the container URL (case-sensitive) referenced in the backup command.

Step 3: Check Network and Firewall Access to Azure Storage

  • From Windows Server 2025, test connectivity using PowerShell:
  Test-NetConnection mystorageacct.blob.core.windows.net -Port 443
  • Confirm outbound HTTPS (port 443) is not blocked by Windows Defender Firewall or corporate proxy.
  • Verify the Azure Storage firewall allows the SQL Server’s public IP or virtual network under Storage Account > Networking.

Step 4: Update SQL Server and Verify Compatibility Level

  • Apply the latest Cumulative Update for SQL Server 2025 via SQL Server Setup or Microsoft Update Catalog.
  • Confirm database compatibility level supports URL backups:
  SELECT compatibility_level FROM sys.databases WHERE name = 'YourDB';
  • Restart the SQL Server service after updates using:
  Restart-Service -Name 'MSSQLSERVER' -Force

Alternative or Verification Steps

  • Run a test backup to a local DISK device first to confirm the database itself backs up correctly, isolating whether the issue is URL-specific.
  • If URL backups still fail, use Azure Storage Explorer to manually validate container permissions and confirm the SAS token hasn’t expired or been scoped incorrectly.