We have a scenario where user got backup MUA operator role to perform critical operation as per microsoft documentation however when he is doing an activity in recovery service vault regarding backup agent cleanup he is getting error "{\"error\":{\"code\"

Hi Arvind Thakur,

Thanks for reaching out to Microsoft Q&A.

The Error servicecontainernotemptywithbackendmessage suggests that the operation the user is attempting requires unlocking privileged access to delete the Resourceguard proxy. The resourceguard proxy provides an extra layer of protection to safeguard critical operations, such as deleting backups, and specific elevated permissions are required.

Suggested solution steps to try & narrowdown the issue:

1. Unlock privileged access for resourceguard proxy:

• Ensure that the user has been assigned the appropriate privileged roles related to the resourceguard configuration. Since you are encountering the error even with elevated permissions (such as contributor), it's important that the user is granted access to unlock the resourceguard proxy through the privileged access management (pim) system. This privilege is required to perform operations like backup agent cleanup.
• Ensure the user has one of the following roles for resourceguard:
• backup admin
• backup operator
• contributor for the Resourceguard itself, specifically for unlocking operations.

2. Review privilege escalation for Resourceguard:

• From the azure backup perspective, check whether the pim role assignments are correctly configured for the recovery Services vault and the associated Resourceguard.
• You may need to escalate privileges temporarily for the user to the backup administrator role specifically within the resourceguard settings to perform the cleanup.

3. Pim assignment verification:

• Ensure that the pim-assigned role is activated and has sufficient permissions to unlock the resourceguard. Sometimes, even though the role is assigned, the activation step might be missed. Verify this in azure ad privileged identity management under the user's active roles.

4. Resourceguard configuration check:

• if the issue persists, check the Resourceguard policies to see if additional configuration changes are needed to allow the user to perform cleanup operations.

Additional recommendations:

if the error persists even after verifying the roles, try assigning the resourceguard owner role temporarily to the user and see if that allows the required operation. You may also want to check the activity log and role assignment log for any warnings or errors when the user is performing the task.

These steps should help address the permission issues tied to the resourceguard and the recovery services vault backup agent cleanup.

Please 'Upvote'(Thumbs-up) and 'Accept' as an answer if the reply was helpful. This will benefit other community members who face the same issue.