Azure Backup and Site Recovery for AZ-104

Introduction

Azure Backup and Azure Site Recovery address different recovery goals: restoring historical data and restarting a replicated workload after an outage. This lesson completes the AZ-104 skills area Monitor and maintain Azure resources (10–15% of the exam). The study guide objective is implement backup and recovery: create a Recovery Services vault and a Backup vault, create and configure a backup policy, perform backup and restore operations by using Azure Backup, configure Azure Site Recovery for Azure resources, perform a failover to a secondary region by using Site Recovery, and configure and interpret reports and alerts for backups.

Two ideas matter. Backup protects against data loss and corruption by keeping point-in-time copies; disaster recovery keeps a workload running by replicating it to another location and failing over. Exam questions describe a recovery requirement (accidental deletion, ransomware, regional outage, retention for seven years) and ask which service, vault, policy or setting satisfies it with the least effort.

After this lesson you will be able to pick a vault type, build a backup policy, back up and restore VMs, files and databases, protect backups from deletion, replicate VMs with Azure Site Recovery, run a failover, and read backup reports and alerts.

Learning objectives

• Distinguish a Recovery Services vault from a Backup vault and name the workloads each supports.
• Configure backup policies: schedule, retention, instant restore snapshots, tiers.
• Back up Azure VMs, Azure Files and blobs; restore a whole VM, disks, or individual files.
• Configure redundancy, cross-region restore, soft delete, immutability and multi-user authorization.
• Replicate VMs to a secondary region with Azure Site Recovery and run test, planned and unplanned failover.
• Configure alerts and use Backup center and reports.

Core concepts: RPO, RTO and the two vault types

• RPO (recovery point objective): the maximum acceptable data loss, measured in time. A successful daily VM backup provides points roughly 24 hours apart; backup failures and cross-region replication lag can increase loss. Site Recovery targets shorter recovery windows, which must be measured for the workload.
• RTO (recovery time objective): the maximum acceptable downtime. Restore and failover durations depend on data size, recovery point, target capacity, networking and application startup. Measure end-to-end recovery rather than treating the service choice as an RTO guarantee.

Azure Backup stores data in a vault, a management and storage container with its own RBAC and security settings.

Remember it simply: VMs, files and databases in VMs, and Site Recovery go in a Recovery Services vault; disks, blobs and PaaS databases go in a Backup vault. For regional Azure backup workloads, place the vault in the same region as the resources it protects (for Azure VM backup, the vault and the VM must be in the same region, although they can be in different resource groups).

To create a Backup vault, open Azure Backup/Resiliency in the portal, choose Backup vault, then select a group, source region, supported redundancy and managed identity. Grant workload-specific permissions before configuring a backup instance. An empty vault does not protect resources. Native MySQL Flexible Server backups remain a separate capability while its Azure Backup preview is paused.

Storage redundancy of the vault

For a Recovery Services vault, choose redundancy before enabling the first backup; it is locked after protection. Backup vault capabilities and operational data stores vary by workload: not every snapshot is copied to vault storage.

Worked example 1: choose the vault

Scenario. Contoso must back up (a) 12 Azure VMs, (b) an Azure Files share, (c) a blob container with invoices, and (d) managed disks of a database VM. The Windows file servers on premises use the MARS agent.

Step 1. VMs, file shares and MARS agent items belong to a Recovery Services vault.

Step 2. Blobs and managed disks belong to a Backup vault.

Solution. Two vaults: a Recovery Services vault for (a), (b) and MARS, and a Backup vault for (c) and (d). Why not one Recovery Services vault for everything? It does not support blob or disk backup. Why not only Backup vaults? They do not support VM backup or Site Recovery.

Backup policies

A backup policy defines when backups run and how long they are kept.

Azure VM policies

• Standard policy: one scheduled backup a day; Enhanced policy: multiple scheduled backups, as often as every four hours, with Premium SSD v2, Ultra Disk and multidisk crash-consistency support. Trusted Launch also supports Standard through documented CLI/PowerShell/REST versions. An Enhanced-protected VM cannot be switched back to Standard.
• Instant restore: Standard daily snapshot retention is 1–5 days (default 2); Enhanced supports 1–30 days (default 7), subject to schedule constraints. Operational snapshots speed recovery and add storage charges.
• Retention: daily, weekly, monthly and yearly points. Typical long-term setting: daily 30 days, weekly 12 weeks, monthly 12 months, yearly 7 years.
• Vault-standard tier and archive tier for rarely needed older points (archive costs less but has a minimum stay and a rehydration delay on restore).

Azure Files: supports snapshot and vaulted backup. Select the tier, schedule and retention supported by the share protocol, region and account. Vaulted backup adds an offsite copy; restore a full share or supported individual items.

SQL Server in a VM: policies combine full, differential and log backups for point-in-time restore.

Consistency levels for VM backup: application-consistent (VSS on Windows, scripts on Linux), file-system consistent, and crash-consistent. The Windows VM agent is installed by default in marketplace images; backup needs the documented extension and permitted service connectivity. Managed identity supplies authorization where supported; it does not create a network path.

The Bash example assumes the groups and supported VM exist in West Europe. Check that DefaultPolicy matches the VM policy type; choose Enhanced where required. CRR is enabled deliberately and cannot later be disabled.

az backup vault create -g rg-bkp -n rsv-prod -l westeurope
az backup vault backup-properties set -g rg-bkp -n rsv-prod --backup-storage-redundancy GeoRedundant --cross-region-restore-flag true

az backup protection enable-for-vm -g rg-bkp -v rsv-prod \
  --vm "$(az vm show -g rg-app -n vm-app01 --query id -o tsv)" --policy-name DefaultPolicy

az backup protection backup-now -g rg-bkp -v rsv-prod -c vm-app01 -i vm-app01 \
  --backup-management-type AzureIaasVM --workload-type VM

Verify the actual container/item names in the vault or with az backup item list; the example assumes unambiguous friendly VM names. Without --retain-until, VM Backup now uses the documented default 30-day retention. Wait for job completion and confirm a usable recovery point.

Backup and restore operations

Azure VMs

Review Azure VM disks, encryption and availability before selecting a restore path.

Enabling backup installs the VM backup extension. A backup job takes a snapshot, then transfers data to the vault. Backup now triggers an on-demand backup with a custom retention date.

Restore options for a VM:

Restore from an instant recovery snapshot is faster than restoring from the vault. Backing up a VM does not stop it. For encrypted VMs, the key vault keys and secrets must be available.

Azure Files and blobs

Combine the backup tier with Azure Files and Blob recovery features for the data you must recover.

Azure Files snapshot or vaulted restore, according to tier support, can be full share or item-level, to the original or an alternate location. Blob backup is operational (continuous, in-account, uses point-in-time restore and requires soft delete, versioning and change feed) or vaulted (copies to a Backup vault with a schedule).

On-premises and the MARS agent

The Microsoft Azure Recovery Services (MARS) agent backs up files, folders and system state from Windows servers to a Recovery Services vault. Download vault credentials, register the server, and define a schedule. Preserve the MARS encryption passphrase separately with controlled access; registration credentials do not replace the passphrase needed for recovery. MABS (Azure Backup Server) and DPM protect application workloads such as Hyper-V and SQL.

Worked example 2: restore a deleted configuration file

Scenario. On Tuesday at 10:00, an administrator deleted C:\apps\erp\settings.xml from vm-erp01. The VM runs, its configuration supports File Recovery, and a successful pre-deletion point exists at 02:00. The selected volumes do not use an unsupported encryption method. Restoring the whole VM would lose Tuesday's work.

Step 1. In the vault, open Backup items > Azure Virtual Machine > vm-erp01 and select File Recovery.

Step 2. Pick the recovery point from Tuesday 02:00 and download the script.

Step 3. Run the signed script/executable as administrator/root on a compatible recovery machine with documented connectivity. Azure RBAC does not grant guest administrator rights. Check encryption, file-system and size restrictions; unsupported encrypted file recovery needs a supported disk/VM restore path.

Step 4. Copy settings.xml and unmount the drives from the portal.

Solution. The file is back with no downtime. Why not Restore VM (Replace existing)? It rolls back the whole disk and loses recent changes. Why not Create new VM? It is an unneeded copy and costs more time.

Protecting backups

Attackers target backups first. Azure Backup offers layered protection.

• Soft delete: deleted backup data is kept for an additional 14 days by default and can be recovered. Enhanced soft delete lets you set 14–180 days and can be made always-on (cannot be disabled). In current regions, soft delete is enabled by default.
• Immutable vaults: prevent deleting recovery points before expiry or reducing retention. An immutability setting can be unlocked (you can still change it) or locked (irreversible). Locked immutability blocks supported destructive operations before expiry; still protect keys, permissions and tested recoverability.
• Multi-user authorization (MUA): critical operations (disabling soft delete, reducing retention, deleting protection) require approval through a Resource Guard, a separately controlled resource. Against a compromised administrator who can elevate access in the production tenant, use Resource Guard in a different tenant, controlled independently. A second subscription in the same tenant is not equivalent isolation.
• Encryption: data is encrypted at rest with platform-managed keys, or with customer-managed keys.
• RBAC roles: Backup Contributor (manage backups, not delete vault or assign access), Backup Operator (run backups and restores, not change policies or remove protection), Backup Reader.
• Private endpoints provide private vault connectivity for supported workloads, with private DNS and documented agent/service paths; they do not replace authorization.

A vault cannot be deleted while it has protected items or soft-deleted items that are still in retention. For legitimate decommissioning, follow workload-specific removal and wait for retention where required. Always-on soft delete and locked immutability cannot be bypassed to delete a vault; also check registered infrastructure and Site Recovery items.

Exam tip. "Prevent a compromised admin from deleting backups" points to a combination of soft delete, an immutable vault and Multi-user authorization.

Azure Site Recovery

Azure Site Recovery (ASR) replicates workloads to a secondary location to support disaster recovery. It is in the Recovery Services vault, and the vault should be in the target region for Azure-to-Azure replication.

Scenarios: Azure VMs to another Azure region, VMware or physical servers to Azure, Hyper-V to Azure.

Azure-to-Azure replication

1. Create a Recovery Services vault in the target region.
2. Enable replication on the VM: choose the target region, resource group, virtual network, and the cache storage account (the Mobility service extension is installed automatically).
3. Pick a replication policy: default retention is one day; app-consistent snapshots are disabled by default (frequency zero). Configure a supported frequency when the application requires them.
4. ASR continuously replicates changes and creates crash-consistent recovery points every five minutes. Create a recovery plan explicitly for ordered multi-VM orchestration; replication does not automatically build the application plan.

A recovery plan groups machines into ordered groups (database first, then application, then web), and can add scripts or manual actions, for example updating DNS.

Failover types

The sequence for a real disaster: Failover, then Commit after application validation (finalizes the point and removes alternatives; required before reprotect), later Re-protect the VM to replicate back, then fail over again to the primary and re-protect once more.

Networking matters: the target VNet and subnets must exist (or be created by ASR), and IP addresses can be kept or changed; use DNS, a load balancer or Traffic Manager so clients find the failed-over application.

Worked example 3: DR design

Scenario. Fabrikam hosts an order system on 6 VMs in West Europe. Requirements: RPO of 15 minutes, RTO of 2 hours, annual DR test without disrupting production, and the database VM must start before the app tier.

Step 1. Daily whole-VM backup alone cannot meet this regional recovery requirement; use Azure Site Recovery to North Europe.

Step 2. Create a Recovery Services vault in North Europe, enable replication for the six VMs.

Step 3. Create a recovery plan with group 1 (database), group 2 (app), group 3 (web) and a post-action script to update DNS.

Step 4. Run test failover into an isolated network each year, then clean up.

Solution. ASR targets these objectives; verify actual replication lag, target capacity and end-to-end test failover, including database readiness and DNS/client reconnection. Why not a daily Azure Backup with CRR? Daily backups provide roughly 24-hour point spacing when successful; failures and CRR replication lag can increase data loss, and full application recovery must be timed. Why not availability zones only? They protect against a datacenter failure but not a regional disaster.

Comparison: backup, snapshots, Site Recovery

Monitoring backups

Use Azure Monitor logs, action groups and alert processing rules to configure reports and route backup alerts.

• Central backup/resiliency management (Resiliency in the current portal; older material calls it Backup center or Azure Business Continuity Center): a single view of vaults, jobs, policies and protected items across subscriptions.
• Backup reports: workbooks based on a Log Analytics workspace. Configure the vault diagnostic settings (using the resource-specific tables, such as AddonAzureBackupJobs) and send to a workspace.
• Alerts: supported built-in alerts cover failures and selected security operations; check workload settings. Use an alert processing rule to add an action group when the built-in alert has no directly configurable group, and create alerts with Azure Monitor for other conditions.
• Azure Monitor metrics for backup health (such as Backup Health Events) exist for several workloads.

Common pitfalls and exam tips

• Wrong vault type: disks and blobs need a Backup vault; VMs need a Recovery Services vault.
• Region: VM backup uses the VM region; the target region is recommended for the ASR vault, which stores configuration rather than replicated disks.
• Redundancy is locked once an item is protected.
• File restore uses File Recovery, not a full VM restore.
• Test failover preserves production replication, but isolate test networks and side effects such as jobs, email and database writes; clean up afterwards.
• Deleting a vault requires removing protected and soft-deleted items first.
• Locks and RBAC do not replace backups, and backups do not replace DR.
• Archive tier reduces cost but increases restore time.

Mini case study: Adventure Works

Adventure Works has these requirements: (1) database VMs must be restorable for 7 years; (2) a ransomware incident must not be able to erase backups, even by a global administrator; (3) the shop in West Europe must be available within one hour if the region fails, losing at most 5 minutes of data; (4) support must recover supported individual files without permission to change backup policies.

Solution.

1. Use a backup policy with yearly retention of 7 years, and archive eligible/recommended points where supported. Evaluate minimum retention, rehydration charges and restore delay before claiming a cost saving.
2. Turn on always-on enhanced soft delete, set the vault to immutable (lock it after testing) and require Multi-user authorization through a Resource Guard in a separate tenant controlled independently by the security team.
3. Daily whole-VM backup is insufficient for this regional target; configure Azure Site Recovery to the paired region with a recovery plan and run test failovers periodically.
4. Grant the minimum documented vault and target-resource restore permissions, using Backup Operator for vault operations, plus controlled guest administrator access on a compatible recovery machine. Teach File Recovery restrictions; the vault role alone cannot authorize executing the guest script.

Why not alternatives? Disk snapshots lack policy management and immutability. GRS alone replicates backups but does not recover a running application. Giving support Backup Contributor allows destructive changes.

Key terms

• RPO / RTO: acceptable data loss and downtime.
• Recovery Services vault / Backup vault: containers for VM, file, database backups and for blobs, disks and PaaS data.
• Backup policy: schedule and retention.
• Soft delete / immutability / MUA: protections against backup deletion.
• Cross Region Restore: restoring from the paired region of a GRS vault.
• Azure Site Recovery / recovery plan: replication service and ordered failover.
• Test, unplanned failover, re-protect: drill, real recovery and reverse replication.

Summary checklist

• I can choose between a Recovery Services vault and a Backup vault per workload.
• I know vault redundancy must be set before protecting items and what CRR provides.
• I can design a policy with schedule, instant restore, long-term and archive retention.
• I can restore a VM, its disks and individual files.
• I can protect backups with soft delete, immutability, Resource Guard and RBAC.
• I can configure Site Recovery replication, a recovery plan and run a test failover.
• I can tell planned, unplanned, commit and re-protect apart.
• I can use backup reports, alerts and the Backup center.

Official sources

• AZ-104 study guide: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-104 (opens in a new tab)

• Azure Backup overview: https://learn.microsoft.com/en-us/azure/backup/backup-overview (opens in a new tab)

• Recovery Services vaults: https://learn.microsoft.com/en-us/azure/backup/backup-azure-recovery-services-vault-overview (opens in a new tab)

• Back up Azure VMs: https://learn.microsoft.com/en-us/azure/backup/backup-azure-vms-introduction (opens in a new tab)

• Security features: https://learn.microsoft.com/en-us/azure/backup/security-overview (opens in a new tab)

• What's new in Azure Backup: https://learn.microsoft.com/en-us/azure/backup/whats-new (opens in a new tab)

• Site Recovery overview: https://learn.microsoft.com/en-us/azure/site-recovery/site-recovery-overview (opens in a new tab)

• Azure-to-Azure disaster recovery: https://learn.microsoft.com/en-us/azure/site-recovery/azure-to-azure-tutorial-enable-replication (opens in a new tab)

• Backup reports: https://learn.microsoft.com/en-us/azure/backup/configure-reports (opens in a new tab)

• Backup RBAC and restore permissions (opens in a new tab)

• Backup data protection and Resource Guard isolation (opens in a new tab)

• Instant Restore retention (opens in a new tab)

• Enhanced VM backup policies (opens in a new tab)

• Azure Files backup tiers (opens in a new tab)

• MySQL Flexible Server backup preview status (opens in a new tab)

• Azure Backup reliability and redundancy (opens in a new tab)

• Site Recovery reliability (opens in a new tab)

• Azure-to-Azure replication defaults (opens in a new tab)

• Failover, commit and failback (opens in a new tab)

• VM File Recovery requirements (opens in a new tab)

• Archive-tier support and charges (opens in a new tab)

• Azure CLI backup protection commands (opens in a new tab)

• Restore VM disks and staging requirements (opens in a new tab)

• Backup center transition to Resiliency (opens in a new tab)