AzCopy Transfer Failed: Read Logs and Resume Safely

When an AzCopy transfer failed, keep its job ID, plan files, and logs before starting another copy. Read the first failed transfer, separate authentication and storage access from network timeouts, then resume only a job whose destinations and remaining operations you have checked.

Key Takeaways:

• Preserve job plans and source files; restarting is different from resuming.
• A 403 needs credential and storage-policy investigation, not repeated route changes.
• Check failed and skipped counts alongside the job's final status.
• Verify destination objects after a real transfer, keeping SAS tokens private.

Step 1: Where did the AzCopy transfer failed result originate?

Identify the computer or service executing AzCopy, its version, operating system, job ID, source role, and destination role. Record whether it was uploading from local storage, downloading, or copying between services. A transfer launched from your laptop can still involve cloud-side activity that a local VPN does not carry.

Save the original command privately with secrets protected. Before sharing it, remove SAS query values, account identifiers where sensitive, private paths, and any authorization material. Retain the original files and current destination state; do not delete a partial result before understanding the job.

AzCopy creates logs and job plans, and the official guide describes how to inspect and resume work using the job ID.［1］ These files have different roles: the log provides events, while the plan identifies work discovered when the job was created. Losing that plan can remove the basis for the intended resume procedure.

If the problem affects many unrelated clients, use the device and application baseline. For a job using another transfer tool, investigate rclone's retry model separately instead of substituting its flags or assumptions into AzCopy.

Step 2: What do the log and transfer counts actually say?

Start with the existing job log, not a new full transfer made solely to generate diagnostics. Find the first relevant error associated with a failed operation and record its time and method. The Microsoft troubleshooting guide distinguishes connectivity, authentication, and other storage errors; the final summary alone may not explain the cause.［2］

Use these command shapes locally after replacing the placeholder with the saved job ID:

azcopy --version
azcopy jobs list
azcopy jobs show YOUR-JOB-ID
azcopy jobs show YOUR-JOB-ID --with-status=Failed

The --with-status value is case-sensitive in the documented interface.［1］ An invalid filter or the wrong job ID can hide the work you meant to investigate. Keep the job summary and the filtered failures together, rather than presenting one empty output as proof that nothing failed.

Note total, completed, failed, and skipped transfers, along with actual bytes and the destination checked. A completed job may exclude selected files or skip existing objects. A status label is evidence about that job, not a substitute for checking the requested dataset.

Step 3: Is this an access failure or an AzCopy network timeout?

Read the error in the context of the account, endpoint, operation, and time. A 403 can have several authorization or storage-policy causes; do not assign all such responses to an expired SAS, and do not treat them as proof that another public exit address is allowed.

Evidence	Responsible branch	Safe next check
403 or an authentication rejection	Credentials, permissions, storage policy	Token scope, expiry, approved access conditions
Connection or read timeout	Route, proxy, endpoint, service interruption	Exact operation, timing, execution device
Rate or service error	Storage service and retry policy	Provider instructions and incident evidence
Source cannot be read	Local path or source access	Preserved source and file permissions
Transfer is skipped	Existing-object or selection policy	Actual intended operation and destination
Private endpoint required	Organization network	Approved private connectivity and DNS owner

Check the credential's validity window and the permission appropriate for the operation through your normal secure process. Do not paste a full SAS into an online decoder, support forum, or screenshot. Credentials should remain private even if they expire soon.

For a storage firewall or IP restriction, the administrator must confirm which route is authorized. A consumer VPN may produce a different public address that is explicitly disallowed. Preserve TLS validation; a certificate error belongs to trust configuration or interception investigation, not an instruction to disable security checks.

Step 4: Can this particular job be resumed safely?

Before choosing an AzCopy resume job operation, verify that the source still represents the intended data and the job's destination remains the approved test location. Confirm the plan file is available at its configured location. Do not move, rename, or purge plans as a first troubleshooting step.

The documented resume procedure uses the job plan and retries work that was not already transferred. SAS tokens are not stored in the plan for security reasons, so a SAS-based job may need the relevant current source or destination token supplied securely again.［1］ That is credential renewal for the same authorized scope, not permission to expand the destination or account.

azcopy jobs resume YOUR-JOB-ID

This basic shape is sufficient only when the original job's authentication requirements are already satisfied. If SAS input is needed, follow the official command guidance and supply only the required side's token privately. Do not put real tokens in article examples or assume every upload requires both source and destination SAS values.

A production job with many remaining writes is not a harmless connectivity test. Ask its owner to approve its resumption or create a separate, bounded test job first. If the existing plan is missing or destinations cannot be verified, stop the resume attempt and reconstruct the authorized task with the owner instead of guessing.

Step 5: How should you isolate a route comparison?

Use a harmless local file and an approved, previously unused destination in a test container. Confirm the selected source and destination before starting it. Keep the same AzCopy version, authentication scope, file, job settings, and storage endpoint when comparing paths; otherwise the observation cannot isolate the route.

If the failed test job is recoverable, preserve that job ID and plan for the second attempt. Do not start a new large recursive copy against the same production path merely because the first job timed out. A narrowly defined recovery provides more useful evidence than another overlapping task with unknown write outcomes.

Check what the AzCopy process inherits from its shell or scheduler. On Windows, review the system proxy context, then confirm the actual process's approved network configuration. A desktop browser using another connection is not a reliable proxy for this command.

Record the starting transfer counts and destination state before changing the route. The second attempt might have less work remaining because the first already sent some objects; label it as recovery evidence rather than claiming a fair speed comparison. If there is no remaining data transfer, a successful resume does not demonstrate that upload traffic works on the new path.

Step 6: Does the remaining public-endpoint transfer work through another permitted path?

Proceed only for a timeout or connection branch, with authorization to use an alternative public route. Private endpoints, enforced proxies, and outbound-IP restrictions remain under the storage owner's control. If an existing VPN appears to cause the problem, compare the permitted direct route before recommending another service.

AethoVPN can provide the outbound comparison on the Windows computer holding the recoverable AzCopy test job: use its official installer and a Pro or Premium desktop plan, select a currently available nearby position, and enable global mode before resuming that job. Keep the plan and resource scope fixed, then inspect the remaining transfers and verify the resulting objects; a 403, expired SAS, storage firewall rule, or private endpoint requirement still needs its own correction. Register by email to start a 3-day free Pro trial for the job recovery check; each user receives the trial once, starting at registration.

For Debian/Ubuntu x64, the official .deb applies on the machine actually running AzCopy. Mac uses the website setup guide and VPN client with Pro or Premium. Do not describe a native Mac application or claim that a client on your local computer reroutes a cloud worker.

Before the resume, verify the VPN connection itself. Record both attempts and stop for an unauthorized route or repeated access error; one recovery does not guarantee availability.

Step 7: Have you verified the destination and closed the test?

Reopen the job statistics and inspect remaining failed entries. Account for skipped objects explicitly: were they already correct, excluded by the task, or not actually transferred? A zero-failure result should still be compared with the intended test object and its expected size and contents.

Read the harmless object back through an approved method into a separate verification location. Where the service and workflow provide suitable integrity metadata, check that as well. Do not assume that every upload automatically stores a content hash, or that a visible filename proves the expected bytes arrived.

Keep a concise incident record containing the job ID, endpoint role, sanitized command, first error, source state, before-and-after counts, actual transmitted data, and destination verification. Separate what was observed from what remains untested, especially service-side copies and private access paths.

Restore temporary diagnostic choices, then let the owner decide when a production job can resume. Remove only approved test objects after retaining evidence; avoid broad container cleanup or job-plan removal that could affect other recoveries. Persistent failures should go to the storage administrator or official support with reviewed excerpts, not public tokens.

Summary

• Keep the job ID, plan files, logs, and original source intact.
• Classify the first failure before changing credentials or routes.
• Resume only reviewed work and record what actually transferred.
• Confirm destination content alongside completed, failed, and skipped counts.

FAQ

Why is starting another copy different from resuming?

A resume uses the original job plan and remaining work. A new invocation discovers a new task and may overlap existing destinations, so review its write scope instead of assuming it is equivalent.［1］

Does every 403 mean my SAS expired?

A 403 can reflect permission or storage-access policy as well as credential conditions. Inspect the named operation and approved scope; do not renew tokens or switch routes without identifying the responsible branch.

Can I resume after removing the plan files?

The documented recovery relies on the job plan. Preserve it before cleanup; if it is unavailable, have the task owner define a new authorized recovery rather than guessing which files remain.

Why does a resume complete without sending bytes?

There may be no remaining eligible work or objects may have been skipped. That result can describe task state, but it does not validate data transmission on the route you just changed.

Should I share my SAS in a support request?

Share only a reviewed, redacted command and error excerpt through the approved support channel. The job log and full URL can contain sensitive material even when the token is short-lived.

Will a local VPN help a private storage endpoint?

Private endpoints require the organization's approved network and naming configuration. A different public exit is not private connectivity and may violate storage firewall or outbound-IP policy.

When is the recovery complete enough to restart production?

Confirm the intended objects, actual transfer counts, and corrected cause first. The owner must separately approve the production scope; a bounded test recovery does not validate an entire migration or backup.

Disclaimer: Resume only authorized jobs and preserve original data. Do not bypass storage access controls, expose credentials, or disable certificate validation to obtain a successful summary.

Sources

1. Microsoft — Find errors and resume jobs with logs in AzCopy — https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-configure
2. Microsoft — Troubleshoot issues in AzCopy — https://learn.microsoft.com/en-us/troubleshoot/azure/azure-storage/blobs/connectivity/storage-use-azcopy-troubleshoot

Sources checked 7 October 2026.

Related Articles

• How rclone separates retries from remote errors
• Check the VPN before rerunning AzCopy
• Windows proxy values AzCopy may pick up