Error: "Failed to lock Virtual Machine for backup: ServerFaultCode: Permission to perform this operation was denied" - Supervisor managed VMs in vSphere Supervisor

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

In a VMware Cloud Foundation (VCF) 9.1 or vSphere Supervisor environment, third-party backup operations for Virtual Machines (VMs) deployed via the VM Service (Supervisor namespace) fail.

The following symptoms are observed:
- Backup software logs report: "Description: Failed to lock Virtual Machine for backup: ServerFaultCode: Permission to perform this operation was denied."
- vCenter vpxd.log contains: "ERROR vpxd [vc@#### sub="Default"] received error code 401 ... Unauthorized"
- Backup proxy logs indicate that 'hotadd' transport mode is being requested: "TransportModeRequested": "hotadd".

Environment

- VMware Cloud Foundation 9.x
- vSphere Supervisor / VMware vSphere Kubernetes Service (VKS)
- Third-party backup solutions using Proxy-based (HotAdd) transport.

Cause

This issue is caused by an architectural limitation in vSphere Supervisor. Virtual Machines managed by the VM Service in a Supervisor namespace do not support the HotAdd transport mode for backup proxies. These VMs are restricted objects, and attempts by a backup proxy to mount their disks (HotAdd) result in permission denials at the vCenter Server level.

Resolution

To resolve this issue, configure the backup software to use a supported data protection method for Supervisor-managed VMs:

Ensure the backup solution utilizes the VMware vSphere Storage APIs – Data Protection (VADP) directly through a mechanism that does not rely on HotAdd/vProxy mounting. Refer to the official documentation for "Backing Up and Restoring VM Service VMs in vSphere Supervisor"