If you manage infrastructure in Azure, chances are you already know you need a backup strategy. What’s less obvious is how much Azure Backup has changed over the past several years, and how it fits into the broader picture of resiliency in Azure. This post breaks down what Azure Backup is, what it protects, where your data actually goes, and how it’s secured and priced, so you have a solid foundation before diving into the hands-on demo in the accompanying video.
What Is Azure Backup?
Azure Backup is part of a larger collection of services grouped under Azure Resiliency, which provides a unified experience for protecting and managing workloads across Azure and hybrid environments. Azure Backup and Azure Site Recovery are both located in Azure Resiliency. They are both similar services that share some underlying technology, but they solve different problems.
Azure Backup is focused on recovering data from the past. That could mean restoring a single file, recovering a database, or bringing back an entire server from a previous point in time. Azure Site Recovery, on the other hand, is built for disaster recovery. Its goal is to bring systems online quickly in another location using the most current data available. Historical recovery points simply aren’t important with Azure Site Recovery.
What Can Azure Backup Protect?
Azure Backup covers a wide range of resources, both in Azure and on-premises. Within Azure, it supports Azure Virtual Machines, Managed Disks, Azure Blobs, Azure Files, multiple types of database servers, Azure Kubernetes Service, and Azure Elastic SAN. For on-premises environments, it can protect virtual machines, files and folders, system state data, Hyper-V, VMware, and other supported workloads running in your data center.
One of the most useful aspects of Azure Backup is how little agent management it requires for Azure-native resources. For Azure Virtual Machines, Azure Backup uses a snapshot management extension that coordinates with Volume Shadow Copy Service, or VSS, to create application-consistent backups. Many other Azure services have backup functionality integrated directly into the Azure control plane, so there’s no separate agent to install or maintain.
For on-premises systems, Microsoft provides the Microsoft Azure Recovery Services (MARS) Agent, which installs on protected systems and sends backup data directly to Azure Backup. Larger environments may also rely on System Center Data Protection Manager (DPM) or Microsoft Azure Backup Server (MABS), both of which are enterprise-grade solutions focused on local backup infrastructure.
Access to Azure Backup is controlled through Azure Role-Based Access Control (RBAC), using three built-in roles. Backup Contributor can manage nearly all backup operations except deleting vaults and managing access permissions. Backup Operator has similar capabilities but can’t delete backups or modify backup policies. Backup Reader provides read-only visibility into backup settings and information.
Where Is Backup Data Stored?
Azure Backup data lives in one of two vault types: a Recovery Services Vault or a Backup Vault. Both store and manage backup data, but the vault you need depends on the workload you’re protecting.
A Recovery Services Vault supports:
- Azure Virtual Machines
- SQL Server running on Azure VMs
- Azure Files
- SAP HANA on Azure VMs
- Azure Backup Server
- The Azure Backup Agent
- System Center Data Protection Manager (DPM)
If you’re protecting any of those workloads, this is the vault you’ll use. A Backup Vault, by contrast, is designed for newer Azure Backup workloads and supports:
- Azure Disks
- Azure Blobs
- Multiple types of Azure Databases
- Elastic SAN Volumes
- Azure Data Lake Storage
- Kubernetes Services
Regardless of which vault type you choose, Azure provides three storage redundancy options: locally redundant storage, geo-redundant storage, and zone-redundant storage. Azure Backup also offers different storage tiers, including snapshot, standard, and archive, with the available options depending on the workload being protected.
How Are Resources Actually Protected?
Backup policies define how and when resources are protected, including backup schedules, retention settings, storage configuration, and recovery point management. There are two policy types: Standard and Enhanced. Standard policies offer a more limited feature set, with fewer scheduling options, shorter snapshot retention, support for locally redundant storage only, and no support for newer VM technologies like Trusted Launch and Ultra Disks. Enhanced policies expand on all of that, which is why they’re the preferred choice in most environments. If you’re already using Standard policies, Microsoft provides a path to move them to Enhanced.
The real advantage of backup policies is scalability. Instead of managing backup settings resource by resource, you assign a policy and manage everything centrally. If your backup requirements change, updating the policy updates protection across every associated resource automatically.
Policies also define how recovery points are created. Azure Backup supports full backups and incremental backups, with incremental backups capturing only the data that has changed since the previous backup to reduce storage consumption and improve efficiency. Differential backups, which capture all changes since the last full backup, are not used by Azure Backup, since they tend to duplicate the same changed data across multiple backups over time.
Built-In Ransomware Protection
Azure Backup plays an important role in ransomware protection strategies. Any backup solution can help you recover from a ransomware attack, but Azure Backup includes protections specifically designed to defend the backup data itself. Backup data is stored in Azure-managed storage, where attackers don’t have direct access to the underlying storage accounts, and data can be encrypted using Microsoft-managed keys or customer-managed keys.
Soft delete helps protect against accidental or malicious deletion by retaining backup data for a limited period after it’s deleted. Azure Backup also supports immutable vaults, which can prevent backup data from being modified or removed, and built-in monitoring and alerting provide visibility into backup-related events and potential security concerns.
Where Is Azure Backup Managed?
If you’ve worked with Azure Backup before, the management experience has changed quite a bit. You may still see references to Azure Backup Center in documentation, but Microsoft now directs administrators toward Azure Business Continuity Center, which in turn leads to Resiliency in the Azure portal. Resiliency provides a unified, cloud-native management experience for backup, disaster recovery, and other protection-related services across your Azure environment.
How Much Does Azure Backup Cost?
One of the advantages of Azure Backup is its simplicity when it comes to cost. There’s no separate backup server licensing model, no license bundles to purchase for protected systems, and no storage pool infrastructure to manage.
For some workloads, such as Azure Virtual Machines, on-premises virtual machines, SAP HANA instances, and SQL Server workloads, you’ll pay a per-protected-instance fee in addition to storage costs. For all protected resources, you’ll also pay for the backup storage consumed. In the end, your total cost depends on the type of resource being protected, the number of protected instances, the amount of backup data stored, the storage redundancy option you select, and the Azure region where your backup vault resides.
See It in Action
Understanding the architecture, security features, and pricing model is a great starting point, but seeing Azure Backup configured from scratch makes the concepts click. In the accompanying video, I walk through a demonstration where I create a Recovery Services Vault, configure a backup policy, and protect an Azure virtual machine from start to finish. Watch the video to follow along and see exactly how these pieces come together in the Azure portal.
Links:
A Beginner’s Guide to the AZ-900
https://www.udemy.com/course/beginners-guide-az-900/?referralCode=C74C266B74E837F86969
Zero to Hero with Azure Virtual Desktop
https://www.udemy.com/course/zero-to-hero-with-windows-virtual-desktop/?referralCode=B2FE49E6FCEE7A7EA8D4
Hybrid Identity with Windows AD and Azure AD
https://www.udemy.com/course/hybrid-identity-and-azure-active-directory/?referralCode=7F62C4C6FD05C73ACCC3
Windows 365 Enterprise and Intune Management
https://www.udemy.com/course/windows-365-enterprise-and-intune-management/?referralCode=4A1ED105341D0AA20D2E
