title: What are the required permissions for the Azure Backup Service?
body: <p>I am met with the following error details when investigating why an Azure encrypted VM backup failed, but the link provided with the error (<a href="https://docs.microsoft.com/en-in/azure/backup/backup-azure-vms-encryption" rel="nofollow noreferrer">https://docs.microsoft.com/en-in/azure/backup/backup-azure-vms-encryption</a>) doesn't resolve my question: <strong>exactly which permissions should I grant?</strong> All it says is that "The required permissions are prefilled for Key permissions and Secret permissions." Well, that's not a lot of help! I had those permissions already set as default I thought, because I do have lots of backups/snapshots; obviously backups have been working in the past. If I am missing some permission now, is it a Key permission, or a Secret permission? It's not clear! I do see I have the following set up right now:</p>
  
  <p><strong>Key permissions:</strong></p>
  
  <p><em>Key Management Operations</em></p>
  
  <ul>
  <li><p><strong>Get</strong> (checked)</p></li>
  <li><p><strong>List</strong> (checked)</p></li>
  <li>Update</li>
  <li>Create</li>
  <li>Import</li>
  <li>Delete</li>
  <li>Recover</li>
  <li><strong>Backup</strong> (checked)</li>
  <li>Restore</li>
  </ul>
  
  <p><em>Cryptographic Operations:</em></p>
  
  <ul>
  <li><p>Decrypt</p></li>
  <li><p>Encrypt</p></li>
  <li><p>Unwrap Key</p></li>
  <li><p>Wrap Key</p></li>
  <li><p>Verify</p></li>
  <li><p>Sign</p></li>
  </ul>
  
  <p><em>Privileged Key Operations</em></p>
  
  <ul>
  <li>Purge</li>
  </ul>
  
  <p><strong>Secret permissions:</strong></p>
  
  <p><em>Secret Management Operations</em></p>
  
  <ul>
  <li><p><strong>Get</strong> (checked)</p></li>
  <li><p><strong>List</strong> (checked)</p></li>
  <li><p>Set</p></li>
  <li><p>Delete</p></li>
  <li><p>Recover</p></li>
  <li><p>Backup</p></li>
  <li><p>Restore</p></li>
  </ul>
  
  <p><em>Privileged Secret Operations</em></p>
  
  <ul>
  <li>Purge</li>
  </ul>
  
  <p><strong>Certificate permissions:</strong></p>
  
  <p><em>Certificate Management Operations</em></p>
  
  <ul>
  <li><p>Get</p></li>
  <li><p>List </p></li>
  <li>Update</li>
  <li>Create</li>
  <li>Import</li>
  <li>Delete</li>
  <li>Recover</li>
  <li>Backup</li>
  <li>Restore</li>
  <li>Manage Contacts</li>
  <li>Manage Certificate Authorities</li>
  <li>Get Certificate Authorities</li>
  <li>List Certificate Authorities</li>
  <li>Set Certificate Authorities</li>
  <li>Delete Certificate Authorities</li>
  </ul>
  
  <p><em>Privileged Certificate Operations</em></p>
  
  <ul>
  <li>Purge</li>
  </ul>
  
  <p>Below is the error I see for my backup:</p>
  
  <p><strong>Error Code</strong></p>
  
  <p>UserErrorKeyVaultPermissionsNotConfigured</p>
  
  <p><strong>Error Message</strong></p>
  
  <p>Azure Backup Service does not have sufficient permissions to Key Vault for Backup of Encrypted Virtual Machines.</p>
  
  <p><strong>Recommended Action</strong></p>
  
  <p>Please grant the required permissions to the Azure Backup Service. Refer <a href="https://azure.microsoft.com/en-in/documentation/articles/backup-azure-vms-encryption/" rel="nofollow noreferrer">https://azure.microsoft.com/en-in/documentation/articles/backup-azure-vms-encryption/</a> </p>
  
  <p><strong>Related Links</strong></p>
  
  <p><a href="https://azure.microsoft.com/en-in/documentation/articles/backup-azure-vms-encryption" rel="nofollow noreferrer">https://azure.microsoft.com/en-in/documentation/articles/backup-azure-vms-encryption</a></p>