5.2AZ-104Intermediate

Est: ~15 mins•Verified: 2026-08

Azure Backup, Recovery Services Vault & Disaster Recovery

Implement enterprise data protection and business continuity using Azure Backup, Recovery Services Vaults, VM snapshot policies, Cross-Region Restore (CRR), Soft Delete, and Azure Site Recovery (ASR).

Tags:#Azure#Backup#Disaster Recovery#Recovery Services Vault#Azure Site Recovery#AZ-104

Overview

Enterprise business continuity and disaster recovery (BCDR) in Microsoft Azure relies on two coordinated services managed under vaults:

Recovery Services Vault & Backup Vault: Storage entities in Azure that house backup data, recovery points, and backup policies across VMs, SQL on Azure VMs, SAP HANA, and Azure Files.
Azure Backup Policy: Defines the frequency of snapshots (e.g., daily, hourly), the retention range (daily, weekly, monthly, yearly - GFS retention), and the backup tier (Snapshot tier vs Vault tier).
Cross-Region Restore (CRR): Allows restoring VMs, disks, and databases in the secondary paired Azure region even if the primary region remains fully operational.
Soft Delete & Multi-User Authorization (MUA): Protects backup data against ransomware or malicious administrators by retaining deleted backup items for 14 to 180 days with Resource Guard protection.
Azure Site Recovery (ASR): Replicates running VM workloads to a secondary target region for near-instant failover (low RTO / low RPO) during catastrophic region outages.

---

When to Use: Azure Backup vs Azure Site Recovery (ASR)

Capability	Azure Backup	Azure Site Recovery (ASR)
Primary Purpose	Point-in-time recovery, historical data protection, compliance retention.	Disaster recovery, business continuity, near-zero downtime failover.
Recovery Point Objective (RPO)	Typically hours to 24 hours (snapshot-based).	Typically seconds to minutes (continuous block-level replication).
Recovery Time Objective (RTO)	Minutes to hours (restoring disks and rebuilding VMs).	Minutes (pre-staged target infrastructure spins up immediately).
Storage Consumption	Compressed backup vaults with tiered storage (Hot/Archive).	Continuous disk replication to cache storage and target replica disks.

---

Prerequisites

Administrator Permissions:

Backup Contributor or Owner on the target resource group and vault.
Azure VMs must have outbound connectivity to Azure Backup service endpoints.

---

Portal Path

TEXT

Azure Portal (https://portal.azure.com)
├── Recovery Services vaults > [Your Vault]
│   ├── Backup policies (Create Enhanced / Standard policy)
│   ├── Backup Items (View protected VMs, trigger on-demand backup)
│   ├── Properties
│   │   ├── Backup Configuration (Storage replication: LRS / GRS / CRR)
│   │   └── Security settings (Soft delete retention: 14 to 180 days)
└── Disaster recovery (Azure Site Recovery)
    └── Replicated items (Configure VM replication to paired region)

---

Step-by-Step Implementation

Step 1: Create Recovery Services Vault with GRS & CRR

Search Recovery Services vaults > click + Create.
Name: rsv-enterprise-prod
Region: Select primary workload region (e.g., westeurope).
Under Backup Configuration (must be configured BEFORE registering backup items):

Storage replication: Geo-redundant (GRS).
Cross Region Restore: Check Enable Cross Region Restore.

Under Security Properties: Enable Soft Delete (set retention to 14 days).

Step 2: Configure VM Backup Policy

In the vault, select Backup policies > click + Add > select Azure Virtual Machine.
Policy sub-type: Enhanced (supports multiple backups per day and trusted launch VMs).
Schedule: Daily at 23:00 UTC.
Instant Restore retention: Retain instant recovery snapshots for 2 days.
Retention Range:

Daily backup: 30 days.
Weekly backup: 12 weeks.
Monthly backup: 12 months.

Step 3: Enable Backup on Target VM

In the vault, click + Backup.
Workload: Azure > Virtual machine.
Backup Policy: Select the newly created policy.
Virtual Machines: Select target production VMs and click Enable backup.

---

Azure PowerShell & Azure CLI

PowerShell: Deploy Vault, Configure Policy, and Trigger Backup

PowerShell

# Connect and set subscription
Connect-AzAccount
Set-AzContext -SubscriptionId "<YOUR-SUBSCRIPTION-ID>"

$rgName = "rg-backup-core"
$vaultName = "rsv-enterprise-prod"
$location = "westeurope"
$vmName = "vm-prod-app01"

# 1. Create Recovery Services Vault
$vault = New-AzRecoveryServicesVault `
    -Name $vaultName `
    -ResourceGroupName $rgName `
    -Location $location

# 2. Set Vault Storage Redundancy to GeoRedundant with CRR
Set-AzRecoveryServicesBackupProperty `
    -Vault $vault `
    -BackupStorageRedundancy "GeoRedundant" `
    -EnableCrossRegionRestore

# 3. Retrieve Default Enhanced Policy
$policy = Get-AzRecoveryServicesBackupProtectionPolicy `
    -VaultId $vault.ID `
    -WorkloadType "AzureVM" | Select-Object -First 1

# 4. Enable Backup for Target VM
Enable-AzRecoveryServicesBackupProtection `
    -ResourceGroupName $rgName `
    -Name $vmName `
    -Policy $policy `
    -VaultId $vault.ID

Write-Host "Backup enabled for $vmName in vault $vaultName" -ForegroundColor Green

# 5. Trigger Immediate On-Demand Backup
$backupItem = Get-AzRecoveryServicesBackupItem `
    -VaultId $vault.ID `
    -WorkloadType "AzureVM" `
    -FriendlyName $vmName

Backup-AzRecoveryServicesBackupItem `
    -Item $backupItem `
    -VaultId $vault.ID `
    -ExpiryDateTimeUTC (Get-Date).AddDays(14)

---

Verification Checklist

VERIFICATION CHECKLIST

0/5 (0%)

Vault storage redundancy is configured as Geo-redundant (GRS) prior to adding backup items.

Initial backup job completes with status: Completed in the vault jobs monitor.

Test Restore executes successfully to an alternate VM or disk without affecting running production instances.

Deleting a backup item places it into Soft Delete state for 14 days rather than immediate purge.

Cross-Region Restore allows recovery in secondary region from the Azure Portal.

Common Pitfalls & Troubleshooting Matrix

Issue	Root Cause	Resolution
Cannot change storage redundancy from GRS to LRS	A backup item is already protected in the vault.	Storage redundancy can only be changed before any items are registered in the vault.
Snapshot backup fails with error 'UserErrorGuestAgentStatusUnavailable'	Azure VM Guest Agent is stopped, corrupt, or firewall blocks communication.	Restart `Windows Azure Guest Agent` service or reinstall the VM agent extension.
Soft Delete prevents decommissioning vault	Soft-deleted backup items remain in the vault for the retention period.	Undelete items, disable soft delete, stop protection and delete data, then remove vault.
Cross-Region Restore disabled/greyed out	Storage redundancy was set to Locally Redundant (LRS) or Zone Redundant (ZRS).	CRR strictly requires Geo-redundant storage (GRS).

---

Real-World Architecture / Flow

Interactive Topology & Workflow

Primary Region (West Europe) Secondary Region (North Europe)default

Stage 1

---

Audit & Monitoring

Monitor backup health using Azure Monitor Alerts:
Built-in alert: Backup Failure (triggers email / webhook upon failed job).
KQL Query to audit backup jobs across all vaults:

```kusto

AddonAzureBackupJobs

| where JobOperation == "Backup"

| project TimeGenerated, BackupItemUniqueId, JobStatus, StorageReplicationType

| order by TimeGenerated desc

```

---

Rollback & Emergency Recovery

Restore VM from Instant Restore Snapshot:
Recreates the VM disk within 2–5 minutes directly from the local snapshot tier without downloading from the vault.
Undelete Soft-Deleted Backup:
Navigate to Backup Items > select soft-deleted item > click Undelete to resume protection.

---

Official Documentation Reference

---

Exam Blueprint & Pro Tips (AZ-104)

Exam Blueprint & High-Yield Traps

AZ-104 High-Yield Rules:

Storage Type Immutability: You cannot change storage redundancy (LRS vs GRS) after protecting the first item. Configure redundancy first!
Cross-Region Restore (CRR): Allows you to perform restore tests in the secondary paired region at any time without Microsoft declaring a regional disaster.
Instant Restore: Saves snapshots locally alongside the VM disks for 1 to 5 days, enabling near-instant RTO for recent rollbacks.
Soft Delete Duration: Default is 14 days; can be extended up to 180 days. Deleting a backup item retains it in soft delete without additional storage costs for the initial 14 days.

PREVIOUS TOPIC5.1 Azure Monitor: Log Analytics & KQL Queries