Veeam Support Knowledge Base
Azure Block Mode Export Failure Due to NetworkAccessPolicyIsDenyAll with Veeam Kasten

Azure Block Mode Export Failure Due to NetworkAccessPolicyIsDenyAll with Veeam Kasten

KB ID:	4765
Product:	Veeam Kasten for Kubernetes
Published:	2025-09-11
Last Modified:	2025-09-11

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

Oops! Something went wrong.

Please, try again later.

Challenge

If using Veeam Kasten to protect persistent volumes provisioned with the Azure Disk CSI provisioner, and encounter the following error during the block mode export phase of a policy run:

Failure in exporting restorepoint

with log details similar to:

Access not permitted for resource /subscriptions/REDACTED/resourceGroups/REDACTED/providers/Microsoft.Compute/snapshots/snapshot-xxxx because the network access policy is DenyAll.

and

"NetworkAccessPolicyIsDenyAll"

Cause

Starting with Azure CSI driver v1.33.3, public network access is disabled by default for new disk creation:

[release-1.33] chore: disable public network access for new disk creation by default by @k8s-infra-cherrypick-robot in #3230

This means all Azure disks (used for Kubernetes PVCs provisioned by Azure CSI) and associated volume snapshots are created with DenyAll network access by default. This results in Kasten being unable to access snapshot data to perform export operations.

Solution

Solution: Update StorageClass to Allow Public Network Access

Create or update the StorageClass with the following parameters:

parameters:
  networkAccessPolicy: AllowAll
  publicNetworkAccess: Enabled

Example StorageClass:{}

allowVolumeExpansion: true
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: default
  annotations:
    storageclass.kubernetes.io/is-default-class: "true"
parameters:
  skuname: StandardSSD_LRS
  networkAccessPolicy: AllowAll
  publicNetworkAccess: Enabled
provisioner: disk.csi.azure.com
reclaimPolicy: Delete
volumeBindingMode: WaitForFirstConsumer
                
            

Note: This only affects newly created PVCs. Existing PVCs/disks will still have the DenyAll policy.

Update Existing Disks and Snapshots

Manually set their network policy to AllowAll using the Azure CLI. See Azure CLI documentation for details.

Example:

az disk update --name <disk_name> --resource-group <resource_group> --network-access-policy AllowAll
                
            

Workaround: Disable Storage API for Block Mode Operations

As a workaround, the use of the storage API for block mode operations can be disabled.

Example:

kubectl annotate storageclass ${STORAGE_CLASS_NAME} k10.kasten.io/block-mode-uses-storage-api=disable

Caution: This is less invasive, but Changed Block Tracking (CBT) features will be lost, and Kasten export operations may be slower due to the use of generic block upload mode.

More Information

Summary

The error occurs due to Azure CSI's default DenyAll network policy on new disks.

Update the StorageClass and/or manually adjust disk policies to AllowAll, or as a workaround, disable storage API usage for block mode operations.

For further information, refer to the official Azure Disk CLI documentation.

If you need more details or troubleshooting help, please contact Veeam support.

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Azure Block Mode Export Failure Due to NetworkAccessPolicyIsDenyAll with Veeam Kasten

Cheers for trusting us with the spot in your mailbox!

Oops! Something went wrong.

Challenge

Cause

Solution

Solution: Update StorageClass to Allow Public Network Access

Update Existing Disks and Snapshots

Workaround: Disable Storage API for Block Mode Operations

More Information

Summary

Spelling error in text

Thank you!

Oops! Something went wrong.

You have selected too large block!

KB Feedback/Suggestion

Thank you!