How to fix Error 3299 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 3299 (BackupToUrl Failure)

Why This Error Happens

Error 3299 occurs when SQL Server 2025’s BACKUP ... TO URL operation fails to properly communicate with Azure Blob Storage, typically due to an expired or malformed Shared Access Signature (SAS) token, an incorrect credential mapping, or a network timeout during the block transfer process. This can also surface when the backup file size exceeds the maximum block blob limits or when the storage account firewall rejects the originating IP address of the Windows Server 2025 host. In some cases, a corrupted or stale CREDENTIAL object in SQL Server retains outdated authentication details, causing the handshake with Azure Storage to fail mid-transfer.

Step-by-Step Resolution Guide

Step 1: Validate the SQL Server Credential Object

  • Run SELECT * FROM sys.credentials; in SSMS to confirm the credential tied to your storage container still exists.
  • Check that the IDENTITY value matches SHARED ACCESS SIGNATURE exactly (case-sensitive).
  • Drop and recreate the credential if the SAS token has expired: DROP CREDENTIAL [https://yourstorageaccount.blob.core.windows.net/yourcontainer];

Step 2: Regenerate and Re-Apply the SAS Token

  • Log into the Azure Portal and navigate to your Storage Account > Shared Access Signature.
  • Ensure permissions include Read, Write, Delete, List, and Create (rwdlc).
  • Set an extended expiration window (minimum 30 days) to avoid mid-backup failures.
  • Re-create the credential in SQL Server using the new token string, omitting the leading ? character.

Step 3: Check Network and Firewall Configuration

  • On Windows Server 2025, open PowerShell and test connectivity: Test-NetConnection yourstorageaccount.blob.core.windows.net -Port 443.
  • In the Azure Portal, confirm the Storage Account’s Networking settings allow the public IP of your SQL Server instance, or that “Allow trusted Microsoft services” is enabled if using a private endpoint.
  • Disable any local Windows Defender Firewall outbound rules blocking port 443 traffic.

Step 4: Adjust Backup Block Size and Compression Settings

  • Reduce the MAXTRANSFERSIZE parameter to 4194304 (4MB) in your backup command to avoid exceeding Azure Blob block limits.
  • Example: BACKUP DATABASE [YourDB] TO URL = 'https://yourstorageaccount.blob.core.windows.net/yourcontainer/yourdb.bak' WITH CREDENTIAL = 'yourstorageaccount', MAXTRANSFERSIZE = 4194304, COMPRESSION;
  • Confirm COMPRESSION is enabled to reduce transfer payload and avoid timeout-related corruption.

Step 5: Review SQL Server Error Logs for Underlying Detail

  • Open SQL Server Configuration Manager and locate the ERRORLOG via C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\Log\.
  • Search for “3299” alongside any nested HRESULT or HTTP status codes (e.g., 403, 404) that indicate the precise Azure-side rejection reason.

Alternative or Verification Steps

  • Run a manual test backup of a small test database (WITH COPY_ONLY) to the same URL to confirm the credential and network path now succeed before resuming production backup jobs.
  • If the error persists, switch to using a Managed Identity-based credential instead of SAS tokens, which eliminates token expiration issues entirely on Windows Server 2025 when paired with Azure Arc-enabled SQL Server.