Get-AzRecoveryServicesVaultSettingsFile gives misleading error message

[pmabbott]

Description

Certain errors when running Get-AzRecoveryServicesVaultSettingsFile surface a JSON parsing error, rather than useful information on the actual problem.

My reproduction revolves around my account not actually having the permissions to run the command, but I've also found Issue #8336, which displays an identical error, relating to a (now fixed) API issue.

When I run Get-AzRecoveryServicesVaultSettingsFile -Backup -Vault $Vault -Path $CredsPath as documented, but without the necessary permissions, I receive an exceptionally opaque error:

At line:1 char:1
+ Get-AzRecoveryServicesVaultSettingsFile -Backup -Vault $Vault -Path ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Get-AzRecoveryServicesVaultSettingsFile], JsonReaderException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.RecoveryServices.GetAzureRmRecoveryServicesVaultSettingsFile

To be clear, this bug report is not "Get-AzRecoveryServicesVaultSettingsFile fails when I run it" (since running the command with -Debug does allow me to see my problem), this bug report is "the error messages from Get-AzRecoveryServicesVaultSettingsFile in some circumstances are unclear and not actionable, and need to be improved".

Issue script & Debug output

> Get-AzRecoveryServicesVaultSettingsFile -Backup -Vault $RCvault -Path $CredsPath -Debug
DEBUG: 09:26:56 - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 09:26:58 - GetAzureRmRecoveryServicesVaultSettingsFile begin processing with ParameterSet 'ForBackupVaultTypeWithCertificate'.
DEBUG: 09:26:58 - using account id 'REDACTED'...
DEBUG: 09:26:58 - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [Az.RecoveryServices], Cmdlet = [Get-AzRecoveryServicesVaultSettingsFile]. Returning default value [True].

<snip>

DEBUG: SharedTokenCacheCredential.GetToken succeeded. Scopes: [ https://management.core.windows.net//.default ] ParentRequestId:  ExpiresOn: 2025-06-18T09:38:44.0000000+00:00
DEBUG: [Common.Authentication]: Received token with LoginType 'User', Tenant: 'REDACTED', UserId: 'REDACTED'
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
PUT

Absolute Uri:
https://management.azure.com/Subscriptions/REDACTED/resourceGroups/rg-uks-vmservices/providers/Microsoft.RecoveryServices/vaults/REDACTED/certificates/REDACTED-6-18-2025-vaultcredentials?api-version=2024-04-01

Headers:
x-ms-client-request-id        : f9588673-c138-4a5c-a5e4-019faa4f8522
accept-language               : en-US

Body:
{}


DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
Forbidden

Headers:
Pragma                        : no-cache
x-ms-failure-cause            : gateway
x-ms-request-id               : ae08a64a-137b-4ed0-bdee-a000282261fe
x-ms-correlation-request-id   : ae08a64a-137b-4ed0-bdee-a000282261fe
x-ms-routing-request-id       : UKSOUTH:20250618T082658Z:ae08a64a-137b-4ed0-bdee-a000282261fe
Strict-Transport-Security     : max-age=31536000; includeSubDomains
X-Content-Type-Options        : nosniff
X-Cache                       : CONFIG_NOCACHE
X-MSEdge-Ref                  : Ref A: 3CD1976D6E344FC894D7E6B7DCA47702 Ref B: DB3EDGE2011 Ref C: 2025-06-18T08:26:58Z
Cache-Control                 : no-cache
Date                          : Wed, 18 Jun 2025 08:26:58 GMT

Body:
{
  "error": {
    "code": "AuthorizationFailed",
    "message": "The client 'REDACTED' with object id 'REDACTED' does not have authorization to perform action 'Microsoft.RecoveryServices/vaults/certificates/write' over scope '/Subscriptions/REDACTED/resourceGrou
ps/REDACTED/providers/Microsoft.RecoveryServices/vaults/REDACTED/certificates/REDACTED-6-18-2025-vaultcredentials' or the scope is invalid. If access was recently granted, please refresh your credentials."
  }
}


DEBUG: 09:26:58 - [ConfigManager] Got nothing from [EnableErrorRecordsPersistence], Module = [Az.RecoveryServices], Cmdlet = [Get-AzRecoveryServicesVaultSettingsFile]. Returning default value [False].
Get-AzRecoveryServicesVaultSettingsFile : Unexpected character encountered while parsing value: T. Path '', line 0, position 0.
At line:1 char:1
+ Get-AzRecoveryServicesVaultSettingsFile -Backup -Vault $RCvault -Path ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Get-AzRecoveryServicesVaultSettingsFile], JsonReaderException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.RecoveryServices.GetAzureRmRecoveryServicesVaultSettingsFile
 
DEBUG: 09:27:00 - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [Az.RecoveryServices], Cmdlet = [Get-AzRecoveryServicesVaultSettingsFile]. Returning default value [True].
DEBUG: 09:27:00 - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 09:27:00 - [ConfigManager] Got nothing from [CheckForUpgrade], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 09:27:00 - No authentication telemetry is found for the current cmdlet with Id f9588673-c138-4a5c-a5e4-019faa4f8522.
DEBUG: AzureQoSEvent:  Module: Az.RecoveryServices:7.7.2; CommandName: Get-AzRecoveryServicesVaultSettingsFile; PSVersion: 5.1.19041.5848; IsSuccess: False; Duration: 00:00:03.9004893; SanitizeDuration: 00:00:00; Exception: Unexpected character encountered while parsing value: T. Path '
', line 0, position 0.;
DEBUG: 09:27:00 - [ConfigManager] Got nothing from [EnableDataCollection], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 09:27:00 - GetAzureRmRecoveryServicesVaultSettingsFile end processing.

Environment data

> $PSVersionTable

Name                           Value                                                                                                                                                                                                                                                          
----                           -----                                                                                                                                                                                                                                                          
PSVersion                      5.1.19041.5848                                                                                                                                                                                                                                                 
PSEdition                      Desktop                                                                                                                                                                                                                                                        
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}                                                                                                                                                                                                                                        
BuildVersion                   10.0.19041.5848                                                                                                                                                                                                                                                
CLRVersion                     4.0.30319.42000                                                                                                                                                                                                                                                
WSManStackVersion              3.0                                                                                                                                                                                                                                                            
PSRemotingProtocolVersion      2.3                                                                                                                                                                                                                                                            
SerializationVersion           1.1.0.1

Module versions

> Get-Module Az*

ModuleType Version    Name                                ExportedCommands                                                                                                                                                                                                                    
---------- -------    ----                                ----------------                                                                                                                                                                                                                    
Script     5.1.0      Az.Accounts                         {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault...}                                                                                                                                                            
Script     10.0.1     Az.Compute                          {Add-AzImageDataDisk, Add-AzVhd, Add-AzVMAdditionalUnattendContent, Add-AzVMDataDisk...}                                                                                                                                            
Script     7.7.2      Az.RecoveryServices                 {Add-AzRecoveryServicesAsrReplicationProtectedItemDisk, Backup-AzRecoveryServicesBackupItem, Copy-AzRecoveryServicesVault, Disable-AzRecoveryServicesBackupAutoProtection...}                                                       
Script     8.0.0      Az.Resources                        {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment...}

Error output

> Resolve-AzError
DEBUG: 09:33:36 - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 09:33:36 - ResolveError begin processing with ParameterSet 'AnyErrorParameterSet'.
DEBUG: 09:33:36 - using account id 'REDACTED'...
DEBUG: 09:33:36 - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [Az.Accounts], Cmdlet = [Resolve-AzError]. Returning default value [True].
DEBUG: 09:33:36 - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [True].


   HistoryId: 25


Message        : Unexpected character encountered while parsing value: T. Path '', line 0, position 0.
StackTrace     :    at Newtonsoft.Json.JsonTextReader.ParseValue()
                    at Newtonsoft.Json.JsonReader.ReadForType(JsonContract contract, Boolean hasConverter)
                    at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.Deserialize(JsonReader reader, Type objectType, Boolean checkAdditionalContent)
                    at Newtonsoft.Json.JsonSerializer.DeserializeInternal(JsonReader reader, Type objectType)
                    at Newtonsoft.Json.JsonConvert.DeserializeObject(String value, Type type, JsonSerializerSettings settings)
                    at Newtonsoft.Json.JsonConvert.DeserializeObject[T](String value, JsonSerializerSettings settings)
                    at Microsoft.Azure.Commands.RecoveryServices.RecoveryServicesCmdletBase.HandleException(Exception ex)
                    at Microsoft.Azure.Commands.RecoveryServices.GetAzureRmRecoveryServicesVaultSettingsFile.ExecuteCmdlet()
                    at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord()
Exception      : Newtonsoft.Json.JsonReaderException
InvocationInfo : {Get-AzRecoveryServicesVaultSettingsFile}
Line           : Get-AzRecoveryServicesVaultSettingsFile -Backup -Vault $RCvault -Path $CredsPath -Debug
Position       : At line:1 char:1
                 + Get-AzRecoveryServicesVaultSettingsFile -Backup -Vault $RCvault -Path ...
                 + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HistoryId      : 25

DEBUG: 09:33:36 - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [True].


   HistoryId: 23


Message        : Unexpected character encountered while parsing value: T. Path '', line 0, position 0.
StackTrace     :    at Newtonsoft.Json.JsonTextReader.ParseValue()
                    at Newtonsoft.Json.JsonReader.ReadForType(JsonContract contract, Boolean hasConverter)
                    at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.Deserialize(JsonReader reader, Type objectType, Boolean checkAdditionalContent)
                    at Newtonsoft.Json.JsonSerializer.DeserializeInternal(JsonReader reader, Type objectType)
                    at Newtonsoft.Json.JsonConvert.DeserializeObject(String value, Type type, JsonSerializerSettings settings)
                    at Newtonsoft.Json.JsonConvert.DeserializeObject[T](String value, JsonSerializerSettings settings)
                    at Microsoft.Azure.Commands.RecoveryServices.RecoveryServicesCmdletBase.HandleException(Exception ex)
                    at Microsoft.Azure.Commands.RecoveryServices.GetAzureRmRecoveryServicesVaultSettingsFile.ExecuteCmdlet()
                    at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord()
Exception      : Newtonsoft.Json.JsonReaderException
InvocationInfo : {Get-AzRecoveryServicesVaultSettingsFile}
Line           : Get-AzRecoveryServicesVaultSettingsFile -Backup -Vault $RCvault -Path $CredsPath -Debug
Position       : At line:1 char:1
                 + Get-AzRecoveryServicesVaultSettingsFile -Backup -Vault $RCvault -Path ...
                 + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HistoryId      : 23


<snip>

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• Get-AzRecoveryServicesVaultSettingsFile : Unexpected character encountered while parsing value: T. Path '', line 0, position 0. #8336

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Unfortunately, due to underlying platform limitations, Az module requires a certificate whereas AzureRM does not. While we are pursuing this PS team, request you to kindly take a look at documentation where we provided an example and re-try (I understand the use case is in Site-recovery but this example is in Backup documentation)

https://docs.microsoft.com/azure/backup/backup-client-automation#registering-using-the-ps-az-module

Reference:

• Get-AzRecoveryServicesVaultSettingsFile : Unexpected character encountered while parsing value: T. Path '', line 0, position 0. #8336 (comment)

Powered by issue-sentinel

[pmabbott]

The auto-response is inappropriate: My bug is about the way such errors are shown to the user, not about addressing one such error.

[pmabbott]

I've just found another way to generate the incomprehensible JSON error, when -Debug makes clear the actual issue:

<snip> 

Body:
{
  "error": {
    "code": "ResourceGroupNotFound",
    "message": "Resource group 'RESOURCEGROUP-FROM-A-DIFFERENT-SUBSCRIPTION' could not be found."
  }
}


DEBUG: 09:58:07 - [ConfigManager] Got nothing from [EnableErrorRecordsPersistence], Module = [Az.RecoveryServices], Cmdlet = [Get-AzRecoveryServicesVaultSettingsFile]. Returning default value [False].
Get-AzRecoveryServicesVaultSettingsFile : Unexpected character encountered while parsing value: R. Path '', line 0, position 0.
At line:1 char:1
+ Get-AzRecoveryServicesVaultSettingsFile -Backup -Vault $RCVault -Path ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Get-AzRecoveryServicesVaultSettingsFile], JsonReaderException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.RecoveryServices.GetAzureRmRecoveryServicesVaultSettingsFile