Fix: Veeam Backup & Replication – Azure REST API Error 409 SnapshotsPresent

The Error

When running a backup job targeting an Azure Blob Storage repository, the job fails with the following error:

Failed to get Azure container immutability config: Azure REST API error. HTTP code: [409]. Azure error: [SnapshotsPresent]. Full error: [Code: [SnapshotsPresent], message: [This operation is not permitted because the blob has snapshots.]]

Root Cause

Veeam creates a test blob named CheckDefaultImmutability/blob in the Azure container to probe the container’s immutability settings before each backup operation. When blob soft delete was previously enabled on the storage account, Azure retains soft-deleted snapshots of this test blob. Even after soft delete is disabled, these orphaned soft-deleted snapshots persist until their retention period expires.

The Azure REST API returns HTTP 409 (SnapshotsPresent) when Veeam attempts to query the immutability configuration on a blob that has any snapshots – including soft-deleted ones. This blocks the AzureBlob.GetContainerImmutability method and causes the backup job to fail.

Check Blob Soft Delete Status

az storage account blob-service-properties show --account-name <STORAGE_ACCOUNT> --resource-group <RESOURCE_GROUP> --query "deleteRetentionPolicy" -o table

If Enabled shows True, disable it:

az storage account blob-service-properties update --account-name <STORAGE_ACCOUNT> --resource-group <RESOURCE_GROUP> --enable-delete-retention false

Identify the Veeam Log Entry

On the Veeam Backup server, run the following PowerShell command to locate the exact error in the logs:

Get-ChildItem "C:\ProgramData\Veeam\Backup\" -Recurse -Filter *.log | Select-String -Pattern "SnapshotsPresent" -List | Select-Object Path, LineNumber, Line

Get context around the error:

Get-ChildItem "C:\ProgramData\Veeam\Backup\Satellites\" -Recurse -Filter *.log | Select-String -Pattern "SnapshotsPresent" -Context 15,15

In the log output, look for the IsSoftDeleteEnabled value and confirm the failing method is AzureBlob.GetContainerImmutability against the CheckDefaultImmutability/blob test blob.

Find Soft-Deleted Snapshots

List soft-deleted blobs and snapshots in the container:

az storage blob list --container-name <CONTAINER> --account-name <STORAGE_ACCOUNT> --include sd --auth-mode login --num-results 50 --query "[?deleted]" -o table

Expected output showing the orphaned test blob snapshots:

Resolution

Step 1: Undelete the Blob

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.

az storage blob undelete --container-name <CONTAINER> --account-name <STORAGE_ACCOUNT> --name "CheckDefaultImmutability/blob" --auth-mode login

Step 2: Delete the Blob Including All Snapshots

az storage blob delete --container-name <CONTAINER> --account-name <STORAGE_ACCOUNT> --name "CheckDefaultImmutability/blob" --delete-snapshots include --auth-mode login

Step 3: Verify Cleanup

az storage blob list --container-name <CONTAINER> --account-name <STORAGE_ACCOUNT> --include sd --auth-mode login --prefix "CheckDefaultImmutability" --query "[?deleted]" -o table

This should return no results.

Step 4: Retry the Backup Job

In the Veeam console, retry the failed backup job. Veeam will create a fresh CheckDefaultImmutability/blob, the immutability check will pass (no snapshots, no policy), and the backup should proceed successfully.

Important Notes

To run these commands, your Azure account needs the Storage Blob Data Contributor role on the storage account.

The CheckDefaultImmutability/blob is a test blob created by Veeam solely to probe immutability settings. It contains no backup data.

Prevention: Per Veeam KB4416, blob soft delete should be disabled on storage accounts used as Veeam Azure Blob repositories. If soft delete was enabled at any point, check for residual soft-deleted snapshots on the CheckDefaultImmutability/blob after disabling it.