Azure Analysis Services backup to azure blob storage using User Managed Identity

Rui Domingos (JTA Consulting S A) 0 Microsoft Vendor

Hi everyone,

I have an azure analysis services that i want to make backups to azure blob storage.
The problem is, i am not able to do that since the company policies does not allow to use access keys.

Is there any way i can configure the backups to use an user managed identity?
or is it possible to create a local backup and then upload to azure blob storage?

Best regards.

Chandra Boorla 5,835 Reputation points Microsoft Vendor

2024-11-25T10:15:16.63+00:00
Hi @Rui Domingos (JTA Consulting S A)

As suggest by @hossein jalilian

Azure Analysis Services doesn't directly support User Managed Identities for backups to Azure Blob Storage. This limitation stems from the current design and implementation of the backup process.

For more details, please refer: Back up to Azure Blob Storage

As I understand that you are facing a couple of issues with configuring backups for Azure Analysis Services and using a User Managed Identity to upload backups to Azure Blob Storage.

"Backup is not configured for this server":

Check Backup Configuration - Ensure that the backup configuration is enabled for your Azure Analysis Services instance. Verify Storage Account: Verify that the specified Azure Storage account and container are accessible and have the necessary permissions. Review Network Security Groups (NSGs): Ensure that NSGs allow traffic between your Azure Analysis Services instance and the storage account.

"The configured backup container is not accessible":

Permissions - Double-check the permissions on the storage account and container. Ensure that the Azure Analysis Services service principal or Managed Identity has the necessary permissions (e.g., Storage Blob Data Contributor). Network Connectivity: Verify network connectivity between the Azure Analysis Services instance and the storage account.

"The backup path c:\database.abf is either too long or violates naming rules":

Azure Storage Naming Conventions - Azure Storage requires specific naming conventions for backup paths. Use a path like /recovery/2024-11-25/db1.abf. Avoid Local Paths: Local paths like c:\database.abf are not supported for Azure Storage backups.

"Add "Azure SSAS Agent User" to Your Container":

You can add the Azure Analysis Services Managed Identity to the container as a role assignment. This will give the service the required permissions to access and write to the container.

In the Azure portal, go to your Blob Storage container. Under Access Control (IAM), add a role assignment for the Azure Analysis Services Managed Identity (you can search for it by name). Assign it a role like Storage Blob Data Contributor or Contributor to ensure it has the necessary permissions.

Note: Configuring the backup container and ensuring proper permissions for the Managed Identity are key points. Additionally, consider the workaround using Azure CLI/PowerShell or Automation to upload the backups to Blob Storage if you can't use native support for User Managed Identity directly.

For additional information, please refer: Create a Full Database Backup

I hope this information helps.

Thank you.
Chandra Boorla 5,835 Reputation points Microsoft Vendor

2024-11-26T08:11:58.1066667+00:00

@Rui Domingos (JTA Consulting S A)

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Thank you.
Chandra Boorla 5,835 Reputation points Microsoft Vendor

2024-11-27T07:59:40.0666667+00:00

@Rui Domingos (JTA Consulting S A)

Following up to see on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Chandra Boorla 5,835 Reputation points Microsoft Vendor

2024-11-28T10:05:47.68+00:00

@Rui Domingos (JTA Consulting S A)

Just checking in to see if the below answer provided by @ Nandan Hegde helped.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

2 answers

hossein jalilian 9,465 Reputation points

2024-11-21T19:16:46.21+00:00
Hello Rui Domingos (JTA Consulting S A),

Thanks for posting your question in the Microsoft Q&A forum.

Azure Analysis Services currently does not natively support using User Managed Identities for backups to Azure Blob Storage. However, there are a couple of alternative approaches you can consider:

Create a local backup of your Azure Analysis Services database, use Azure CLI or Azure PowerShell with a User Managed Identity to upload the backup file to Azure Blob Storage.

Create an Azure Automation account with a User Managed Identity, develop a runbook that performs the backup and uploads it to Azure Blob Storage and schedule the runbook to run at desired intervals.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful
Please sign in to rate this answer.
Rui Domingos (JTA Consulting S A) 0 Reputation points Microsoft Vendor

2024-11-21T21:22:09.9133333+00:00

Hi hossein jalilian,

Thanks for your answer.
I did a couple of tests but with no success.

First, i tried make a "local" backup, but i got the error "Backup is not configured for this server. Contact the administrator of the server to configure a backup storage account using Azure portal or PowerShell."
I check the Azure portal

When i try to enable, i can only select an azure blob storage container.
But then i got the error "The configured backup container is not accessible"
If i tried a local backup, "c:\database.abf", i got the error "The backup path c:\database.abf is either too long or violates naming rules for Azure Storage blobs. Valid examples: /recovery/10.12.2016/db1.abf, recovery/10.12.2016/db1.abf"

I am not sure is there is a way of adding the "azure ssas agent user" to my container or if this can help.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Nandan Hegde 33,001 Reputation points MVP

2024-11-27T14:02:55.4466667+00:00

You can use powershell to generate the backup of the AAS locally :

https://zcusa.951200.xyz/en-us/powershell/module/sqlserver/backup-asdatabase?view=sqlserver-ps

And then upload that into blob

As stated above, Azure automation can be one such offering to achieve the same
Please sign in to rate this answer.
Rui Domingos (JTA Consulting S A) 0 Reputation points Microsoft Vendor

2024-11-27T17:44:53.7266667+00:00

Hi @Nandan Hegde ,

I'll try to generate a local file. I'll let you know.

Thanks
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Analysis Services backup to azure blob storage using User Managed Identity

2 answers

Your answer