Recovery Services vault

A Recovery Services vault is the central storage entity in Azure that manages the backup configuration, backup jobs, and associated backup data for Azure IaaS VMs, Azure file share, SQL, and SAP HANA database backups and other workloads supported by the service. The vault also serves as a central location to monitor and manage backups configured using Azure Backup Server, DPM, Windows Server, and more.

The main features of the vault include the following:

• Centralized management and monitoringThe Recovery Services vault provides a single central management console to set up, manage, and monitor backups configured using the MARS agent. This makes it easy to keep an eye on backup status and set up alerts in case of backup or restore failures.

• Enhanced security of backed-up dataThe Recovery Services vault allows you to set up a security PIN that prevents unauthorized configuration changes and data deletion. Whenever someone attempts such an action in the service, the vault enforces the PIN requirement; if the wrong PIN is entered, the action will be denied. For on-premises backups, the vault enforces a 16-character passphrase that is set up at the time of backup creation and is used to encrypt the data when stored in Azure.

• Role-based access control (RBAC) using Azure ADThe Recovery Services vault supports RBAC leveraging Azure AD to control and limit access to the service only to authorized administrators based on their role or operational requirements.

• Data resiliency and recoveryThe vault supports integration with LRS, ZRS, and GRS Azure Storage accounts to provide data resiliency across zones within an Azure region or across Azure regions. The vault also supports data restoration across paired Azure regions, thereby helping in scenarios where data must be brought online in a secondary region, or audit or compliance checks must be adhered to.

• Protection against malicious attacksThe vault protects against malicious attacks by allowing the restoration of clean data before the date of the attack based on your retention policies. If you have enabled soft delete data retention, then the vault ensures that any malicious deletion of the vault data can be recovered for a period of 14 days after the deletion.

• Scalable by designAzure currently supports 1,000 VMs using the MARS agent, 2,000 backup data sources or items, and 200 backup policies per Recovery Services vault. At present, each subscription supports 500 Recovery Services vaults, making it a highly scalable service that can address the backup requirements for most large organizations.

Backup Center

Backup Center provides a unified management experience for enterprises to govern, monitor, operate, and analyze backups at scale. As such, it is consistent with Azure’s native management experiences. Backup Center offers the following:

• Single pane of glass to manage backupsBackup Center is designed to function well across a large and distributed Azure environment. You can use the Backup Center to efficiently manage backups spanning multiple workload types, vaults, subscriptions, regions, and Azure Lighthouse tenants.

• Data source-centric managementBackup Center provides views and filters centered on the data sources you’re backing up—for example, VMs and databases. This allows a resource owner or a backup admin to monitor and operate backups of items without focusing on which vault an item is backed up to. A key feature of this design is the ability to filter views by data source-specific properties, such as data-source subscription, data-source resource group, and data-source tags. For example, if your organization assigns different tags to VMs belonging to different departments, you could use Backup Center to filter backup information based on the tags of the underlying VMs being backed up without needing to focus on the tag of the vault.

• Connected experiencesBackup Center provides native integrations to existing Azure services that enable management at scale. For example, the Backup Center uses Azure Policy to help you govern your backups. It also leverages Azure workbooks and Azure Monitor Logs to provide you with detailed reports on backups. So, you don’t need to learn any new principles to use the varied features that the Backup Center offers. You can also discover community resources from the Backup Center.

Data plane

Azure Backup is broken down into two main components: the data plane and the management plane. Each plane provides specific functions and complements the other to ensure the service works as intended.

The functions performed by the data plane include the following:

• Data protectionThe data plane ensures that the data-protection policies set up in the vault configuration are adhered to. It ensures that any data that is accidentally or maliciously deleted is available for recovery for 14 days. This is provided at no additional cost to all customers, as long as they enable the configuration.

• Data encryption at restThe data plane ensures that all backup data at rest is encrypted based on the encryption configuration set up in the service. It performs data decryption as needed in the event of a data-restore operation.

• Data lifecycle managementThe data plane manages the entire lifecycle of the backup data, ensuring that it adheres to the retention policies set up in the vault configuration.

• Storage-management automationThe data plane manages the automatic provisioning, resizing, and scaling of the storage accounts used for the backup data.

Management plane

The management plane performs an additional set of complementary functions that support the overall management and access security of the vault. These include the following:

• Backup policy managementThe management plane provides the capability to centrally configure and manage backup and retention policies.

• Enforcement of RBAC controlsThe management plane provides the capability to configure RBAC permissions to control and limit access to the vault to authorized admins based on their role requirements. It monitors, authorizes, and logs all access requests, making it easier to track unauthorized requests.

• Support for management toolsThe management plane provides the capability to manage the Recovery Services vault using the Azure Portal, Azure PowerShell, Azure CLI, REST APIs, and Backup Center.

• Reporting and managementAll reporting, alerting, and management functionality is configurable thanks to capabilities provided within the management plane. It supports integration with Log Analytics for centralized backup monitoring across multiple vaults.

• Faster restores using snapshotsThe management plane handles snapshot backups for Azure VM and Azure files, which allow for faster data restores than from a storage vault. This can help you reduce the RTO in your environment during any data-restore operations.

Backup agents

Azure Backup service components provide two main types of backup agents:

• MARS agentThis supports system-state, file-level, and folder-level backups of Azure IaaS VMs and on-premises Windows Servers. It integrates with DPM and MABS servers to store local disk backups from those components in Azure for long-term retention.

• Azure VM extensionThis is installed only on Azure IaaS VMs to carry out entire VM-level backups.

Supported backup types

Azure Backup supports various types of backups, which are selected based on the workload being backed up. Each type of backup provides different capabilities for backup and restoration. In general, most backup policies include a combination of these backup types to provide faster backups and limit data loss:

• Full backupsThese are backups of target data sources that include entire VMs, databases, or file/folder structures. You should always start any new backup with a full backup to provide Azure Backup with a full copy of the data source, which it will need before it can perform any incremental, differential, or transaction log backups. Azure Backup currently allows only one full backup per day.

• Differential backupsDifferential backups contain data from the last full backup. These types of backups are supported for SQL and SAP HANA databases running in Azure VMs. Differential backups are not the most efficient, as they take repeated backups of data modified since the last full backup, regardless of any changes to the data taking place on that day. It is important to use this backup type carefully. It can help speed up restores in certain scenarios, such as database backups, but also can result in additional use of backup storage. Azure Backup allows only one differential backup per day, and not on the same day as a full backup.

• Incremental backupsThese backups contain data from the last full or incremental backup. Incremental backups are supported by SAP HANA databases running in Azure VMs. They are more efficient than differential backups, as they only back up changes since the last backup. This reduces any redundant backups of unchanged blocks. Incremental backups cannot be scheduled along with differential backups. Only one of the two can be set up to run on a regular basis. Incremental backups can be performed only once per day, and not on the same day as a full backup.

• Transaction log backupsThese backups are supported by both SQL and SAP HANA databases running in Azure VMs. They are incremental log backups of the databases running on the target VMs. They can be scheduled to run once every 15 minutes at most. You can use transaction log backups along with full and incremental backups for a comprehensive database-backup strategy.

Backup policy

A backup policy defines a backup’s schedule and retention configuration. You can apply different backup policies to different workloads, based on each workload’s schedule and retention requirements. For example, you might create a backup policy that backs up a critical application server at 9 p.m. each day, with a retention of 365 days. In contrast, you might create a backup policy that backs up a non-critical application server every Sunday at 9 p.m., with a retention of four weeks.

You can have a maximum of 200 policies per vault and 100 items targeted per policy. If multiple applications or servers have the same retention and scheduling requirements, it is best to use the same backup policy to avoid hitting the subscription limit. If you reach the limit of 100 items for that policy, create a duplicate policy for the remaining items.

Backup compression

Azure Backup supports the compression of on-premises backup data at the source before it is transferred to the Recovery Services vault. This compression is a feature of the MARS agent set up for file or folder backups in the on-premises servers or the Azure Backup Server solution. Backups of Azure VMs using the backup extension do not support compression.

Backup monitoring

Azure Backup has a built-in monitoring engine that keeps track of all backup agents, scheduled backup jobs, job results, restore jobs, and other related administrative activities. You can use this built-in engine to monitor each Recovery Services vault. However, to monitor this information across multiple vaults, it is better to use other options, such as the following:

• Backup ExplorerBackup Explorer is a pre-defined workbook provided by Microsoft as part of the Azure Monitor service. It provides a singular view of all backups and restore jobs, including job history across all backup vaults to which the admin has access. It can quickly help identify workloads that are currently not set up for backups.

• Azure Monitor with Log AnalyticsYou can configure Azure Backup to store all logs in a Log Analytics workspace. Azure Monitor can create visualizations and alerts for job monitoring across multiple vaults.

Alerts

Azure Backup provides a built-in alerting engine that sends email-based alerts to defined users or distribution groups based on identified triggers. Examples of triggers might be backup failures, restore failures, backup data or protection deletion, and so on. The built-in engine provides sufficient capabilities to set up alerts for standard alerting scenarios. However, if custom alerts are required to address the scenarios not covered by the built-in engine, you can use Azure Monitor to set up alerts using Log Analytics for log ingestion.

Security

Azure Backup is secured on multiple levels, starting with backup data security during transit and at rest and extending to service access controls.

With regard to data in transit, Azure ensures that all data transferred from the MARS agent to Azure Backup and storage occurs over HTTPS. Additionally, any data transfer between Azure Backup and storage uses HTTPS, ensuring data security during transit.

Azure encrypts all data stored in the Azure storage (in other words, data at rest) using platform-managed keys or customer-managed keys stored in the Azure Key Vault service. This helps ensure that data is not readable if stolen from the back end. Azure Backup also supports the backup of Azure data encrypted disks using BitLocker encryption with Azure Key Vault integration.

Azure Backup service uses Azure role-based access control (RBAC) for granular access control of the Recovery Services vault. You can use pre-defined security roles available in RBAC to assign access to admins based on their roles and duties. These roles include the following:

• Backup contributorsMembers can create and delete vaults; enable new backups; create, delete, and manage backup policies; stop and delete backup protection; and perform all operators activities.

• OperatorsMembers can trigger backup and restore jobs.

• ReadersMembers can read the backup configuration only.

You can also create custom roles with permissions per your environment and assign them to admins for granular control. Apart from the backup service itself, the back-end storage accounts that hold all the backup data are another point of concern. Azure ensures that another user or service, apart from Azure Backup service, cannot access these storage accounts during operations such as backups or restores.

Azure Backup walkthrough

The following sections walk you through the process of creating a Recovery Services vault and setting up Azure Backup to back up your Azure VMs using the Azure Portal, Azure PowerShell, and the Azure CLI. If you are following along, be sure to select resources and resource names based on your environment, including unique Recovery Services vault names for each of your deployments. Also be sure to delete any unwanted resources after you have completed testing to reduce charges levied by Microsoft for these resources.

#Register the vault service
Register-AzResourceProvider -ProviderNamespace "Microsoft.RecoveryServices"

#Define variables
$vaultname = "RecoveryServicesVault01"
$rg = "RG01"
$location = "EastUS2"
$VM = "SourceVM"
#Create Recovery Services vault
New-AzRecoveryServicesVault -ResourceGroupName $RG -Name $vaultname -Location $location

#Set the storage redundancy and cross region restore config
Get-AzRecoveryServicesVault -Name $vaultname | Set-AzRecoveryServicesVaultContext
Get-AzRecoveryServicesVault -Name $vaultname | Set-AzRecoveryServicesBackupProperty -BackupStorageRedundancy GeoRedundant –EnableCrossRegionRestore

#Create Backup policy
$SchedulePolicy = Get-AzRecoveryServicesBackupSchedulePolicyObject -WorkloadType "AzureVM"
$Date = Get-Date
$SchedulePolicy.ScheduleRunTimes.Add($Date.ToUniversalTime())
$Retention = Get-AzRecoveryServicesBackupRetentionPolicyObject -WorkloadType "AzureVM"
$Retention.DailySchedule.DurationCountInDays = 30
$policy = New-AzRecoveryServicesBackupProtectionPolicy -Name CustomBackupPolicy01 -RetentionPolicy $Retention -SchedulePolicy $SchedulePolicy -VaultId $vaultname.ID -WorkloadType AzureVM

#Enable Azure VM Backup
Enable-AzRecoveryServicesBackupProtection -ResourceGroupName $RG -Name $VM -Policy $policy

#Trigger Backup Now
$bkpcontainer = Get-AzRecoveryServicesBackupContainer -ContainerType "AzureVM" -FriendlyName $VM
$bkpitem = Get-AzRecoveryServicesBackupItem -Container $bkpcontainer -WorkloadType "AzureVM"
Backup-AzRecoveryServicesBackupItem -Item $item

#Monitor backup status
Get-AzRecoveryservicesBackupJob

#Define variables
vaultname = "RecoveryServicesVault01"
rg = "RG01"
location = "East US 2"
vm = "SourceVM"
#Create the Recovery Services vault
az backup vault create --resource-group $rg 
    --name $vaultname 
    --location $location

#Set vault storage replication type and cross region restore config
az backup vault backup-properties set --name $vaultname 
    --resource-group $rg 
    --backup-storage-redundancy "GeoRedundant" 
    --cross-region-restore-flag "True"

#Enable backup for SourceVM
az backup protection enable-for-vm --resource-group $rg --vault-name $vaultname --vm $vm --policy-name DefaultPolicy

#Start the Backup Now
az backup protection backup-now --resource-group $rg --vault-name $vaultname --container-name $vm --item-name $vm --backup-management-type AzureIaaSVM --retain-until 02-02-2021

#Monitor backup progress
az backup job list --resource-group $rg --vault-name $vaultname --output table