Status: Active
Posted: 20 October 2026, 13:00 (UTC)
Azure Virtual Machine block-based restores are failing as a result of unannounced changes to Azure role permissions.
See Article 1672 for a workaround.
On 13 October 2026 at 15:05 UTC, Microsoft made changes to the built-in Azure role Disk Snapshot Contributor. The change removed four storage account permissions from the role: read, write, delete, and list keys.
Some restore paths in our system use this role to create a temporary storage account in the customer's subscription during a restore. As a result, these restores now fail.
At the time of writing, Microsoft's documentation still lists these permissions as part of the role, and we have found no announcement of the change from Microsoft. We have opened a support ticket with Microsoft and are awaiting a response.
- Services affected since 13 October 2026, 15:05 UTC:
- Any Azure Virtual Machine restore to a new VM from a block-based backup
- Any Azure Storage Account restore to a new storage account
- Affected regions: All
Update history:
- 20 October 2026, 13:00 (UTC): Posted
- 21 October 2026, 09:32 (UTC): Workaround added