Forum Discussion
Unable to backup APIM instance to storage account
I have a Standard V2 APIM instance and a storage account that has public access disabled but allows traffic from the Integration subnet of the APIM and the "Microsoft.ApiManagement/Service" resource type and the specific instance of APIM allowed access. It also has the "Allow trusted MIcrosoft Services to access this resource" selected.
Integration subnet of APIM has the "Microsoft.Storage" service connection configured.
I am following this MS KB to setup the backup:-
https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-disaster-recovery-backup-restore?tabs=powershell#back-up-an-api-management-service
And using the "Access using managed identity" method. The Service principal that I am using in Powershell & Managed Identity of APIM has been given the "Storage Blob Data Contributor" role on the storage account.
When I run the following 2 commands from a VM in the same VNET as the APIM Instance I get error: "Backup-AzApiManagement : Long running operation failed with status 'BadRequest'."
$storageContext = New-AzStorageContext -StorageAccountName $storageAccountName
Backup-AzApiManagement -ResourceGroupName $apiManagementResourceGroup -Name $apiManagementName -StorageContext $storageContext -TargetContainerName $containerName -TargetBlobName $blobName -AccessType "SystemAssignedManagedIdentity"
Storage logs seems to indicate that it successfully does the "putblob" operation and within few milliseconds does the "DeleteBlob" operation.
APIM activity logs have the following error for "Backup API Management Service":-
"message": "Unable to backup API service at this time. Please, retry the operation.If the issue persists, please contact support providing correlation ID
How can I troubleshoot this further or what needs to change in my setup to allow the backup?
V2 Standard does not support backups:-
https://learn.microsoft.com/en-us/azure/api-management/api-management-features
3 Replies
For APIM backup to a locked-down storage account, I would separate identity/RBAC from network reachability.
Identity side:
- The APIM managed identity needs Storage Blob Data Contributor on the target storage account or container.
- The identity running the PowerShell/REST backup call also needs permission to trigger the APIM backup operation.
- Confirm you are using the managed identity mode in the request, not accidentally falling back to access key/SAS behavior.
Network side:
- Service endpoint on the APIM integration subnet is not always enough if the backup operation is performed by the APIM control plane rather than traffic originating exactly like normal subnet traffic.
- If public network access is disabled, test whether a private endpoint for blob plus correct private DNS is required for the storage path you are using.
- The trusted Microsoft services checkbox is not a blanket allow for every Azure service/control-plane operation, so I would not rely on it as proof APIM backup can reach the account.
As a quick isolation test, temporarily allow the storage account from selected networks plus the relevant subnet/public path, run one backup, then lock it down again. If that works, the remaining issue is storage firewall/private endpoint path rather than RBAC.
Docs:
https://learn.microsoft.com/azure/api-management/api-management-howto-disaster-recovery-backup-restore
https://learn.microsoft.com/azure/storage/common/storage-network-securityBuilt-in APIM backup and restore is not supported on the v2 Tiers, including Standard v2.
https://learn.microsoft.com/en-us/azure/api-management/api-management-features
V2 Standard does not support backups:-
https://learn.microsoft.com/en-us/azure/api-management/api-management-features
