Lesson 21 — Azure Backup & Recovery Services Vault

Domain 5 — Monitor & Maintain AZ-104: 10–15% ~30 min Prereq: Lesson 20 — KQL & Log Analytics

Why You Need This

Monitoring tells you when something goes wrong. Backup is what saves you after it does. Azure Backup is the cloud-native backup service that protects virtual machines, file shares, databases, and on-premises servers — all managed through a unified vault model. Understanding the two vault types, the backup policy parameters, and the restore options is essential for the AZ-104 exam and for day-to-day Azure administration.

In production, the question is never whether to back up — it is always how long you can afford to lose data (RPO) and how fast you need to recover (RTO). Those two numbers drive every backup policy decision you will make.

Two Vault Types — Know Which to Use When

Azure Backup uses two different vault resource types. They are not interchangeable. The exam will test this distinction directly.

FeatureRecovery Services VaultBackup Vault
Resource type Microsoft.RecoveryServices/vaults Microsoft.DataProtection/backupVaults
Azure VM backup Yes — primary use case No
Azure Disk backup No Yes
Azure Blob backup No Yes
Azure Files backup Yes No
SQL in Azure VM Yes No
SAP HANA in Azure VM Yes No
On-premises via MARS/MABS Yes No
Azure Database for PostgreSQL No Yes
Maturity Original, full-featured Newer, simplified API-based model
Exam rule to memorise Azure VM backup → Recovery Services Vault. Azure Disk backup → Backup Vault. Azure Files → Recovery Services Vault. When in doubt about newer services (Blobs, PostgreSQL, AKS), the answer is Backup Vault — it is the forward-looking vault type for Azure PaaS data.

Azure VM Backup

Backing up an Azure VM with Azure Backup requires no agent for a basic VM snapshot — the Backup service uses the Azure fabric to take a snapshot of the managed disks. For application-consistent backups (SQL, etc.), the VM Snapshot extension is installed automatically.

Application-consistent backups

A crash-consistent backup captures the exact disk state at the moment of the snapshot. An application-consistent backup goes further: it quiesces in-flight transactions before the snapshot so the resulting backup can be restored to a clean state without transaction log replay.

  • Windows: uses VSS (Volume Shadow Copy Service) — coordinates quiescing across all VSS-aware writers (SQL Server, Exchange, etc.)
  • Linux: uses pre-script and post-script hooks configured per VM — the pre-script freezes the application, the backup runs, the post-script thaws it
Crash-consistent vs. app-consistent If VSS is unavailable (a VSS writer error, for example), Azure Backup falls back to a file-system-consistent backup (frozen filesystem, no VSS). This is still better than a crash-consistent backup but may require SQL log replay on restore. Monitor backup jobs for VSS warnings — they often indicate SQL Server issues.

Backup policy parameters

ParameterOptions / RangeNotes
Backup frequency Daily or weekly Daily is the standard for production VMs
Backup time Specific UTC time Schedule during low-traffic windows to minimise VSS impact
Instant restore snapshot retention 1–5 days Snapshots retained locally in the storage account for fast restore. Longer retention = higher cost.
Daily recovery point retention Up to 9,999 days One recovery point per day kept for this many days
Weekly recovery point retention Up to 5,163 weeks Which day of the week to designate as the weekly recovery point
Monthly recovery point retention Up to 1,188 months For long-term retention (LTR) / compliance archiving
Yearly recovery point retention Up to 99 years Regulatory requirements may mandate 7-year retention

Restore options

When restoring an Azure VM backup, you have three distinct options — each suited to a different recovery scenario:

Restore optionWhat it doesWhen to use
Create new VM Provisions a completely new VM from the recovery point — new resource IDs, new NIC, new disk Full VM failure; you need a clean replacement VM quickly
Restore disks Restores the OS and data disks to a storage account as VHDs, which you then attach to an existing VM You want to control VM configuration post-restore; good for testing before cutting over
File recovery Mounts the backup recovery point as a file system on a running VM using a script; you browse and copy individual files, then unmount Restoring one or a few files without full VM restore — fastest for partial recovery
Replace existing disk Replaces an existing disk of the backed-up VM in place with the recovery point disk VM still exists but you need to roll back the OS disk to a previous state

Instant restore

When a backup runs, Azure Backup first takes a snapshot of the VM's managed disks and retains it in the source storage account for 1–5 days (configurable). Restoring from a snapshot is dramatically faster than restoring from the vault because the data never leaves the storage account — there is no transfer from vault storage to compute.

After the snapshot retention period expires, the backup data is transferred to vault storage and the snapshot is deleted. Restores from vault storage take significantly longer, proportional to disk size.

Soft Delete

Soft delete is a critical security feature that protects backup data from ransomware attacks and accidental deletion by administrators.

When backup data is deleted (by stopping protection and deleting backup data, or by deleting a backup item), Azure Backup retains the data in a soft-deleted state for 14 additional days. During this period:

  • The backup data is marked as "soft deleted" and cannot be permanently purged
  • Storage costs still apply during the soft delete period
  • The data can be recovered ("undeleted") at any time within the 14 days
  • After 14 days, data is permanently deleted and cannot be recovered
Never disable soft delete in production Soft delete is enabled by default on all Recovery Services Vaults and should remain enabled. Disabling it requires explicit configuration and creates a window where a single admin action or ransomware payload can permanently destroy all backup data with no recovery path. If an attacker gains access to an account with Backup Operator role, soft delete is the last line of defence.
Enhanced soft delete (preview) The enhanced soft delete feature extends the protection: soft delete becomes always-on and cannot be disabled, and the retention period can be extended up to 180 days. This is the recommended configuration for high-security environments.

Azure Files Backup

Azure Backup for Azure Files uses share snapshots stored in the same storage account as the file share itself. These snapshots appear in the storage account as point-in-time copies and can be managed directly through Azure Backup policies.

  • Backup is coordinated through a Recovery Services Vault, but the snapshot data lives in the storage account (not transferred to vault storage)
  • Restore: full share restore, or individual file/folder restore to the original or an alternate location
  • Maximum backup frequency: 4 backups per day
  • Maximum retention: 200 recovery points per share
Storage account protection Because Azure Files backup snapshots live inside the storage account, deleting the storage account destroys the backup data. Always apply a CanNotDelete resource lock to storage accounts that hold Azure Files backups.

MARS Agent — On-Premises Backup to Azure

The Microsoft Azure Recovery Services (MARS) agent enables backing up on-premises Windows Server machines directly to a Recovery Services Vault in Azure — without requiring any Azure infrastructure (no Azure VMs, no Azure Backup Server).

What MARS backs up

  • Files and folders (file-level granularity — not a full disk image)
  • Windows System State (registry, boot files, COM+ database, Active Directory for domain controllers)

What MARS does NOT back up

  • Linux systems — MARS is Windows-only
  • Full disk/VM images — for those, use Microsoft Azure Backup Server (MABS) or DPM
  • Application-consistent backups of SQL Server — SQL in Azure VM requires the dedicated SQL backup solution
MARS vs. MABS MARS is the lightweight agent for individual Windows Servers backing up files directly to the vault. MABS (Microsoft Azure Backup Server) is a full backup server product (similar to DPM) that can protect application workloads (Exchange, SharePoint, Hyper-V VMs) and then transfer those backups to Azure. MARS is the exam answer for "on-premises Windows file backup to Azure" scenarios.

Backup Center and Backup Reports

Backup Center

Backup Center is the unified management console for Azure Backup across all vault types, subscriptions, and regions. From one blade you can:

  • View all backup jobs across all vaults and subscriptions in one grid
  • Monitor backup health — which VMs have protection configured, which do not
  • Create and manage backup policies centrally
  • Configure backup for new resources at scale
  • View compliance against backup policies (which resources have not had a successful backup in the last 24 hours)

Backup Reports

Backup Reports is an Azure Monitor Workbook that provides historical reporting on backup jobs, protected instances, policy compliance, and cost estimation. It requires:

  1. Routing backup diagnostic logs to a Log Analytics workspace via diagnostic settings on each vault
  2. Waiting for data to populate (typically 24 hours before meaningful data is available)

Without the Log Analytics routing, Backup Reports shows no data. This is an extremely common misconfiguration — always configure diagnostic settings when deploying a Recovery Services Vault.

Vault Storage Redundancy

Recovery Services Vaults can be configured with three storage redundancy options, selected at vault creation. The configuration cannot be changed after backup data has been stored.

Redundancy typeCopiesCross-region restoreUse when
LRS (Locally Redundant) 3 within a single datacenter No Dev/test; when regulatory requirements prohibit data leaving the region
GRS (Geo-Redundant) 3 locally + 3 in secondary region Yes (requires explicit enablement) Production workloads needing DR capability. Default for new vaults.
ZRS (Zone-Redundant) 3 across availability zones within the region No When zone resiliency within a single region is the primary requirement
Cross Region Restore requires GRS Cross Region Restore allows you to restore a VM backup into the secondary (paired) region during a primary region outage. It must be explicitly enabled in the vault properties and requires the vault to use GRS storage. LRS vaults cannot use Cross Region Restore. This is a frequently tested AZ-104 scenario.
Change window is narrow You can change vault redundancy settings only before any backup data is stored in the vault. Once you protect the first item and a backup runs, the redundancy type is locked. Set GRS at vault creation time for all production vaults — retrofitting later means creating a new vault, re-protecting all items, and waiting for initial backups to run.

RPO and RTO for Azure Backup

These two metrics define the business requirements that your backup design must satisfy. Getting these numbers from the business is the first step in any backup strategy.

MetricDefinitionAzure Backup reality
RPO
(Recovery Point Objective)		 Maximum data loss tolerated — how far back in time can you afford to restore? With daily backup: up to 24 hours of data loss. A failure just before the next scheduled backup = worst case RPO.
RTO
(Recovery Time Objective)		 Maximum downtime tolerated — how fast must the service be back online? Instant restore (from snapshot): fastest — minutes. Restore from vault storage: slower, proportional to disk size and bandwidth.
When Backup is not enough If your business requires RPO of minutes (not hours) or RTO of seconds, Azure Backup cannot meet that requirement. Azure Site Recovery (ASR) provides continuous replication with RPO as low as seconds and supports planned/unplanned failover with RTO of minutes. Lesson 22 covers ASR. The exam frequently tests this boundary: Backup for accidental deletion and data corruption; ASR for disaster recovery with tight RPO/RTO.

Check Your Understanding

Click any option to see immediate feedback.

1. You back up a Windows VM running SQL Server using Azure Backup. What mechanism ensures the SQL database is in a consistent state in the backup?

Azure Backup for Azure VMs creates application-consistent backups on Windows using VSS (Volume Shadow Copy Service). VSS coordinates with registered VSS writers — including the SQL Server VSS writer — to quiesce in-flight transactions before the snapshot, guaranteeing the backup is in a transactionally consistent state that can be restored without log replay errors.

2. A developer accidentally deleted a single configuration file from a production VM. How should you recover it using Azure Backup without restoring the entire VM?

File Recovery allows you to mount a backup recovery point as a local drive on any target VM using a download script. You browse the mounted filesystem, copy the specific files you need, and then run the unmount script. This is the fastest and least disruptive option for recovering individual files — no full VM restore required.

3. A junior admin stops protection on a VM and deletes its backup data. Fifteen minutes later, you discover the error. Can you recover the backup data?

Soft delete is enabled by default on Recovery Services Vaults and retains deleted backup data for 14 days in a soft-deleted state. During this window, the data appears in the vault with a "Soft deleted" status and can be recovered ("undeleted") by a Backup Admin. This protects against both accidental deletion and ransomware attacks that target backup data.

4. Your primary Azure region (East US) is experiencing a widespread outage. You need to restore a VM backup to the West US paired region. What vault configuration must be in place for this to be possible?

Cross Region Restore has two hard requirements: the vault must use GRS storage (which replicates backup data to the secondary paired region), and Cross Region Restore must be explicitly enabled in the vault's Properties blade. Without both, the secondary region restore option simply does not appear in the portal. LRS and ZRS vaults cannot perform cross-region restores.

5. You restore a VM from a recovery point taken 2 days ago. The recovery takes 8 minutes. What does this tell you about the recovery point used?

Instant restore snapshots are retained in the same storage account as the VM's disks for 1–5 days (configurable in backup policy). Restoring from a snapshot is dramatically faster than restoring from vault storage because the data never needs to be transferred from the vault — it is already co-located with the VM. An 8-minute restore for a production VM indicates snapshot-based recovery. Vault-based restores for large VMs can take significantly longer.

6. Your SLA for a critical business application requires RPO of 5 minutes. Can Azure Backup meet this requirement?

Azure Backup for VMs supports daily backup (RPO up to 24 hours) or weekly backup. There is no 5-minute backup frequency for VMs. For an RPO of minutes, the correct solution is Azure Site Recovery, which provides continuous replication with crash-consistent recovery points every 5 minutes and app-consistent recovery points every 1–12 hours. Backup and ASR solve different problems: Backup for operational recovery (accidental deletion, corruption); ASR for disaster recovery.
Primary source for this lesson What is Azure Backup? — Microsoft Learn

Walk through the support matrix article to understand exactly which workloads each vault type supports — the exam tests this at a detailed level. Also review the backup policy design guide to understand retention hierarchy design for LTR (Long-Term Retention) scenarios.

Questions for your teacher (the AI agent)
This lesson covered Azure Backup fundamentals. Go deeper on:
  • Walk me through designing a backup policy that meets a 7-year legal retention requirement for financial data on Azure VMs.
  • What is the difference between stopping protection and retaining data vs. stopping protection and deleting data — and when would you use each?
  • How do I configure Backup Reports to show backup compliance across 50 subscriptions in a single dashboard?
  • When should I use MABS (Microsoft Azure Backup Server) instead of the MARS agent, and what does MABS add?
Coming up: Lesson 22 — Azure Site Recovery & Network Watcher Backup protects against data loss over time. The next lesson covers Disaster Recovery — Azure Site Recovery replicates entire VMs continuously so you can fail over with seconds of data loss. We'll also cover Network Watcher, Azure's toolset for diagnosing network connectivity issues — IP flow verify, next hop analysis, connection monitor, and NSG flow logs.