Azure Backup Vault Design

Azure Backup Vault is a storage entity in Azure that houses backup data for certain Azure workloads. It is distinct from the Recovery Services Vault (RSV), which is used for Azure Virtual Machines, SQL Server in Azure VMs, SAP HANA, and Azure Files. The Backup Vault is designed specifically for newer Azure backup workloads, including:

It provides a centralized management and compliance boundary for backups, supporting features like soft delete, immutability, encryption at rest with platform-managed keys (PMK) or customer-managed keys (CMK), and role-based access control (RBAC).

Microsoft introduced Backup Vault to address the limitations of Recovery Services Vault for newer workload types. RSV was originally built for classic VM and file backup scenarios, relying on the Azure Backup Agent and the MARS agent. Backup Vault is a more modern architecture that:

When you configure a backup for a supported workload (e.g., Azure Blob), the Backup Vault triggers an initial full backup. For blob operational backups, this is a snapshot of the storage account at a point in time. For vaulted backups, data is copied to the vault's storage, which is a separate Azure Blob Storage account managed by Azure Backup. The process involves:

Using Azure CLI:

# Create a Backup Vault
az backup vault create --name MyBackupVault --resource-group MyRG --location westus

# Enable soft delete (default is enabled)
az backup vault backup-properties set --name MyBackupVault --resource-group MyRG --soft-delete-state Enabled

# Enable immutability (once enabled, cannot be disabled)
az backup vault backup-properties set --name MyBackupVault --resource-group MyRG --immutability-state Locked

# Create a backup policy for blob vaulted backup
az backup policy create --backup-management-type AzureBlob --vault-name MyBackupVault --resource-group MyRG --policy-name MyBlobPolicy --schedule "R/2023-01-01T00:00:00+00:00/P1D" --retention-duration 30

# List recovery points
az backup recoverypoint list --vault-name MyBackupVault --resource-group MyRG --backup-management-type AzureBlob --container-name MyStorageAccount

Using PowerShell:

New-AzDataProtectionBackupVault -SubscriptionId $subId -ResourceGroupName MyRG -VaultName MyBackupVault -Location westus -StorageSetting @{type="LocallyRedundant"; datastoreType="VaultStore"}

Update-AzDataProtectionBackupVault -SubscriptionId $subId -ResourceGroupName MyRG -VaultName MyBackupVault -SoftDeleteState "On"

A multinational bank must retain transaction logs stored in Azure Blob Storage for 7 years to meet regulatory requirements. They use Azure Backup Vault with vaulted backups set to daily with a 7-year yearly retention. Immutability is enabled to prevent tampering, and CRR replicates backups to a paired region for disaster recovery. The vault uses CMK stored in a managed HSM (Hardware Security Module) to satisfy key sovereignty. Private endpoints are configured to ensure backup traffic never leaves the corporate network. The bank monitors backup health via Azure Monitor and sets alerts for any failures. A common issue is that the vault's managed identity lacks permissions on the key vault, causing backup failures. They resolved this by assigning the 'Key Vault Crypto Service Encryption User' role at the key scope.

An e-commerce company runs containerized applications on AKS. They use Azure Backup Vault to back up persistent volumes and application state via the Backup Extension. They configure a daily backup policy with 30-day retention. The backup extension is deployed on the AKS cluster with a managed identity that has permissions to read the cluster and write to the vault. They also enable operational backups for the AKS cluster's etcd data. A challenge they faced was that the backup extension's pod could not pull images from a private container registry; they had to grant ACR pull permissions. They also use Azure Backup's restore capabilities to quickly spin up a new cluster in a different region for disaster recovery testing.

A healthcare provider uses Azure Database for PostgreSQL (Single Server) for patient data. They use Azure Backup Vault for long-term retention of database backups. They configure a weekly full backup with monthly retention for 1 year. To meet HIPAA compliance, they enable soft delete and immutability. They also use CRR to replicate backups to a secondary region. A common misconfiguration is that the vault's storage redundancy is set to LRS, but they needed GRS for cross-region failover. They had to recreate the vault with GRS. They also learned that the vault's backup policy cannot be changed after creation for PostgreSQL; they had to create a new policy and attach it.