Design business continuity solutions · Topic 2 of 4
Backup Solutions for Compute, Databases and Unstructured Data
AZ-305 backup design: Azure Backup vaults and policies for VMs, SQL, Files and Blobs, immutable vaults, cross region restore and long term retention.
- 5 min
- Recovery Services vault: VMs, SQL and SAP HANA in VMs, Azure Files, MARS. Backup vault: disks, blobs, PostgreSQL, Kubernetes.
- Enhanced policy allows multiple backups a day and supports Trusted Launch. Standard is once a day.
- Cross Region Restore needs a GRS vault. Archive tier is not supported on ZRS vaults.
What it is
A backup is a point in time copy you can restore after deletion, corruption or ransomware. Azure Backup is the managed service for most Azure workloads. The design questions are which vault, which policy (frequency and retention), how to protect the backups themselves and where restores can happen.
How it works
Vault types and what they protect
| Vault | Workloads |
|---|---|
| Recovery Services vault | Azure VMs, SQL Server in Azure VMs, SAP HANA in Azure VMs, Azure Files, plus on premises with the MARS agent, Azure Backup Server and DPM |
| Backup vault | Newer workloads: Azure Disks, Azure Blobs (vaulted backup), Azure Database for PostgreSQL, and Kubernetes services |
A Recovery Services vault is regional, so you need a vault in each region with VMs to back up, and up to 500 vaults per subscription. Cross subscription backup is possible. The vault's storage redundancy (LRS, ZRS or GRS) is chosen before the first backup. GRS vaults enable Cross Region Restore to the paired region.
Backup for compute
- Azure VM backup takes application consistent snapshots with the VM agent and stores recovery points in the vault. A Standard policy backs up once a day. An Enhanced policy allows several backups a day, down to every four hours, and is required for Trusted Launch VMs and other newer VM features.
- Instant restore keeps snapshots locally for fast recovery (days), then the vault holds the long term points. Restore options: full VM, disks, files and folders, or to another region (with cross region restore).
- Selective disk backup excludes disks you do not need.
- SQL Server and SAP HANA in VMs use workload aware backups with full, differential and log backups and point in time restore, with a backup extension on the VM. Log backups can run as often as every 15 minutes.
- Azure Backup Server or MARS protect on premises servers and files.
- Azure Kubernetes Service backup protects cluster state and persistent volumes (Backup vault).
Backup for databases
| Database | Backup |
|---|---|
| Azure SQL Database and Managed Instance | Automatic backups with point in time restore (default 7 days, configurable up to 35) and long term retention (LTR) up to 10 years |
| Azure Database for PostgreSQL and MySQL | Automatic backups with PITR, and long term retention options |
| Cosmos DB | Periodic (default) or continuous backup with PITR |
Use the built in automatic backup for PaaS databases. Use Azure Backup for databases on VMs.
Backup for unstructured data
| Data | Option |
|---|---|
| Blobs | Operational backup (continuous, in the same account, with soft delete, versioning and change feed, short retention) and vaulted backup (copies to a Backup vault for longer retention and protection from account deletion) |
| Azure Files | Share snapshots, and Azure Backup with scheduled snapshots managed by a vault |
| Storage account protections | Soft delete, versioning, point in time restore, immutability and locks |
| Azure Data Lake Gen2 | Blob protections with careful design, because some features have restrictions with hierarchical namespace |
Protecting backups
| Control | Effect |
|---|---|
| Soft delete | Deleted backup data stays recoverable for a period (14 days by default, and can be enhanced) |
| Immutable vault | Blocks operations that would reduce retention or delete recovery points, even by privileged users. Can be locked |
| Multi user authorization (MUA) | A Resource Guard requires a second administrator to approve destructive backup operations |
| Encryption | At rest, with customer managed keys optional |
| Private endpoints | Remove public network paths |
| Azure RBAC | Backup Contributor, Backup Operator and Backup Reader roles |
| Monitoring | Backup center / Business Continuity Center, alerts and reports |
Immutability plus MUA is the standard answer to ransomware where an attacker with admin credentials might try to delete backups.
Long term retention and cost
- The Archive tier stores older monthly and yearly recovery points for VMs, SQL and SAP HANA in VMs at low cost. It is not supported on ZRS vaults.
- Match retention to requirements: daily 30 days, weekly 12 weeks, monthly 12 months, yearly several years.
- Vault Standard is the normal online tier.
- Pick LRS for lower cost when regional recovery is not needed, ZRS for zone resilience, and GRS with cross region restore for regional protection.
Choosing quickly
| Requirement | Answer |
|---|---|
| RPO of 4 hours for VMs with Trusted Launch | An Enhanced backup policy |
| Keep SQL Database backups for 7 years | Long term retention (up to 10 years) |
| Protect backups from a compromised admin | Immutable vault with multi user authorization |
| Restore a VM in the paired region during a regional outage | GRS vault with Cross Region Restore |
| Protect blobs long term and from account deletion | Vaulted blob backup |
| Back up on premises file servers | MARS agent or Azure Backup Server |
A worked scenario
A logistics firm runs VMs with Trusted Launch, a SQL Server on VMs and file shares. It needs 4 hour RPO for VMs, 15 minute log backups for SQL, and 7 year retention. The architect creates a GRS Recovery Services vault with an Enhanced policy every four hours, SQL workload backup with log backups every 15 minutes, Azure Files backup, and moves yearly points to the archive tier. The vault is immutable with multi user authorization to resist ransomware.
What to remember for the exam
- Recovery Services vault: VMs, SQL and SAP HANA in VMs, Azure Files, MARS. Backup vault: disks, blobs, PostgreSQL, Kubernetes.
- Enhanced policy allows multiple backups a day and supports Trusted Launch. Standard is once a day.
- Cross Region Restore needs a GRS vault. Archive tier is not supported on ZRS vaults.
- SQL Database keeps PITR for 7 to 35 days and long term retention up to 10 years.
- Immutable vault plus multi user authorization protects backups from deletion.
"Protect from ransomware that deletes backups" means soft delete, immutable vault and multi user authorization.
How the exam asks about this
- "Back up a VM several times a day." An Enhanced policy.
- "Restore in another region after a regional outage." GRS vault with Cross Region Restore.
- "Even a global admin must not shorten retention." An immutable vault, locked.
- "Keep database backups for 10 years." Long term retention.
Common mistakes
Choosing a Backup vault for SQL in a VM. It belongs in a Recovery Services vault.
LRS vault for regional recovery. Cross Region Restore needs GRS.
Backing up only with snapshots in the same account. Use vaulted protection.
Forgetting to lock immutability. An unlocked policy can be changed.
Check yourself
Which policy type supports Trusted Launch VMs and several backups a day?
Enhanced.
Which vault storage option enables Cross Region Restore?
GRS.
What protects backups from a compromised administrator?
An immutable vault with multi user authorization.
Topic 2 of 4 in Design business continuity solutions
Test yourself on Design business continuity solutions
The full Microsoft AZ-305 question bank has 755 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.