Azure Backup failures

Keep the vault and VM for both breaks.

1Break it: the VM agent stops

A hardening script stops the Azure guest agent. Stop it with a 20-second delay, so this Run Command can still report back:

az vm run-command invoke --resource-group rg-saat-l69 --name vm-bk --command-id RunShellScript --scripts 'systemd-run --on-active=20 systemctl stop walinuxagent; echo scheduled' --query "value[0].message" -o tsv
Start-Sleep -Seconds 120
az vm get-instance-view --resource-group rg-saat-l69 --name vm-bk --query "instanceView.vmAgent.statuses[0].displayStatus" -o tsv
$until = (Get-Date).AddDays(30).ToString('dd-MM-yyyy')
az backup protection backup-now --resource-group rg-saat-l69 --vault-name rsv-l69 --container-name vm-bk --item-name vm-bk --backup-management-type AzureIaasVM --retain-until $until -o none

The agent shows Not Ready. Wait for the job to finish (it can take 30 minutes or more to give up), then look:

az backup job list --resource-group rg-saat-l69 --vault-name rsv-l69 --query "[0:3].{operation:properties.operation, status:properties.status, start:properties.startTime, error:properties.errorDetails[0].errorCode}" -o table

You should see something like this:

Operation    Status     Start                             Error
-----------  ---------  --------------------------------  -------------------------------------
Backup       Failed     2026-10-21T08:58:11.123456+00:00  UserErrorGuestAgentStatusUnavailable

The vault couldn’t reach the agent, so it never took a snapshot. Read the full message with az backup job show; it says the VM agent is unable to communicate with Azure Backup. Nothing is wrong with the vault or the policy.

To read the full error and the recommended action for any failed job, take its name from the list and show its error details:

$job = az backup job list --resource-group rg-saat-l69 --vault-name rsv-l69 --status Failed --query "[0].name" -o tsv
az backup job show --resource-group rg-saat-l69 --vault-name rsv-l69 --name $job --query "properties.errorDetails[0].{code:errorCode, message:errorString, fix:recommendations[0]}" -o json

Fix it: start the agent. Run Command needs the agent, so restart the VM instead (or start the service from the Serial Console, Lesson 60), then back up again:

az vm restart --resource-group rg-saat-l69 --name vm-bk -o none
az vm get-instance-view --resource-group rg-saat-l69 --name vm-bk --query "instanceView.vmAgent.statuses[0].displayStatus" -o tsv
$until = (Get-Date).AddDays(30).ToString('dd-MM-yyyy')
az backup protection backup-now --resource-group rg-saat-l69 --vault-name rsv-l69 --container-name vm-bk --item-name vm-bk --backup-management-type AzureIaasVM --retain-until $until -o none

The agent is Ready again and the new backup job completes.

2Break it: a restore to the wrong region

Someone restores the disks using a storage account they already had in South India:

$sfx = Get-Random -Minimum 10000 -Maximum 99999
az storage account create --resource-group rg-saat-l69 --name stl69s$sfx --location southindia --sku Standard_LRS -o none
$rp = az backup recoverypoint list --resource-group rg-saat-l69 --vault-name rsv-l69 --container-name vm-bk --item-name vm-bk --backup-management-type AzureIaasVM --query "[0].name" -o tsv
az backup restore restore-disks --resource-group rg-saat-l69 --vault-name rsv-l69 --container-name vm-bk --item-name vm-bk --rp-name $rp --storage-account stl69s$sfx --target-resource-group rg-saat-l69

The restore is rejected, with an error that says the vault and the storage account are in different regions, something like this:

The Recovery Services vault and target storage account are in two different regions.

The staging account holds the VM configuration and, for some restores, the disk data while it’s being restored. It must be in the vault’s region.

Fix it: create a staging account in Central India and restore again, then check the job:

az storage account create --resource-group rg-saat-l69 --name stl69c$sfx --location centralindia --sku Standard_LRS -o none
az backup restore restore-disks --resource-group rg-saat-l69 --vault-name rsv-l69 --container-name vm-bk --item-name vm-bk --rp-name $rp --storage-account stl69c$sfx --target-resource-group rg-saat-l69 -o none
az backup job list --resource-group rg-saat-l69 --vault-name rsv-l69 --query "[0:3].{operation:properties.operation, status:properties.status, start:properties.startTime, error:properties.errorDetails[0].errorCode}" -o table

After a while you should see a Restore job Completed, and new managed disks in rg-saat-l69.

3Clean up

Stop protection and delete the backup data, then delete the group (soft delete is off on this vault):

az backup protection disable --resource-group rg-saat-l69 --vault-name rsv-l69 --container-name vm-bk --item-name vm-bk --backup-management-type AzureIaasVM --delete-backup-data true --yes -o none
az group delete --name rg-saat-l69 --yes
az group list --query "[?starts_with(name, 'AzureBackupRG')].name" -o tsv

The last command lists Azure Backup’s restore point groups. Leave them if other VMs are protected; they hold instant restore snapshots.

✅ Checkpoint: You fixed a backup that failed because of the VM agent and a restore that failed because of the staging account region.