#1 Global Leader in Data Resilience
#1 Global Leader in Data Resilience
TRY NOW
book meeting
BACK TO KB LIST

Azure Block Mode Export Failure Due to NetworkAccessPolicyIsDenyAll with Veeam Kasten

KB ID: 4765
Product: Veeam Kasten for Kubernetes
Published: 2025-09-11
Last Modified: 2025-09-11
mailbox
Get weekly article updates
By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

error icon

Oops! Something went wrong.

Please, try again later.

Challenge

If using Veeam Kasten to protect persistent volumes provisioned with the Azure Disk CSI provisioner, and encounter the following error during the block mode export phase of a policy run:

Failure in exporting restorepoint

with log details similar to:

Access not permitted for resource /subscriptions/REDACTED/resourceGroups/REDACTED/providers/Microsoft.Compute/snapshots/snapshot-xxxx because the network access policy is DenyAll.

and

"NetworkAccessPolicyIsDenyAll"

Cause

Starting with Azure CSI driver v1.33.3, public network access is disabled by default for new disk creation:

[release-1.33] chore: disable public network access for new disk creation by default by @k8s-infra-cherrypick-robot in #3230

This means all Azure disks (used for Kubernetes PVCs provisioned by Azure CSI) and associated volume snapshots are created with DenyAll network access by default. This results in Kasten being unable to access snapshot data to perform export operations.

Solution

Solution: Update StorageClass to Allow Public Network Access

Create or update the StorageClass with the following parameters:

parameters:
  networkAccessPolicy: AllowAll
  publicNetworkAccess: Enabled
Example StorageClass:{} 
allowVolumeExpansion: true
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: default
  annotations:
    storageclass.kubernetes.io/is-default-class: "true"
parameters:
  skuname: StandardSSD_LRS
  networkAccessPolicy: AllowAll
  publicNetworkAccess: Enabled
provisioner: disk.csi.azure.com
reclaimPolicy: Delete
volumeBindingMode: WaitForFirstConsumer
Note: This only affects newly created PVCs. Existing PVCs/disks will still have the DenyAll policy.
Update Existing Disks and Snapshots

Manually set their network policy to AllowAll using the Azure CLI. See Azure CLI documentation for details.

Example:

az disk update --name <disk_name> --resource-group <resource_group> --network-access-policy AllowAll

Workaround: Disable Storage API for Block Mode Operations

As a workaround, the use of the storage API for block mode operations can be disabled.

Example:

kubectl annotate storageclass ${STORAGE_CLASS_NAME} k10.kasten.io/block-mode-uses-storage-api=disable
Caution: This is less invasive, but Changed Block Tracking (CBT) features will be lost, and Kasten export operations may be slower due to the use of generic block upload mode.

More Information

Summary

  • The error occurs due to Azure CSI's default DenyAll network policy on new disks.
  • Update the StorageClass and/or manually adjust disk policies to AllowAll, or as a workaround, disable storage API usage for block mode operations.

If you need more details or troubleshooting help, please contact Veeam support.

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

Thank you!

Thank you!

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please, try again later.

You have selected too large block!

Please try select less.

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.
Verify your email to continue your product download
We've sent a verification code to:
  • Incorrect verification code. Please try again.
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend
Start using Veeam:
Download the product
&
Activate the license key
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

error icon

Oops! Something went wrong.

Please, try again later.