Create a Recovery Services Vault in Azure

Azure Recovery Services Vault — Quick Reference

Fast lookup for backup workloads, storage, security, encryption, limits & recovery options.

Core Overview

Storage entity for backup data and recovery points.
Holds copies of data/config for VMs, workloads, servers, workstations.
Based on Azure Resource Manager; supports hybrid backup scenarios.
Central monitoring for Azure Backup and Azure Site Recovery.
Easy organization of backup data with minimal management.

One vault per region; can manage multi-region replicas with GRS/GZRS.

Supported Workloads

Azure VMs: Windows, Linux (IaaS).
SQL Server: Databases in Azure VMs; application-aware backup.
SAP HANA: Database in Azure VMs; low RPO support.
Azure Files: File shares; share-level or item-level restore.
On-premises: MARS agent, DPM, MABS; servers and workstations.

See backup support matrix for complete workload compatibility.

Storage Redundancy

Type	Scope	Availability	Cost
LRS	Single datacenter	Low	Lowest
GRS	Primary + secondary region	High	Higher
GZRS	Multi-zone + secondary region	Highest	Highest
ZRS	Multi-zone (same region)	High	Medium

Set at vault creation; may be changeable afterward (review docs). GRS default for production.

Security & Data Protection

Encryption at rest: Platform-managed (default) or customer-managed keys (CMK).
Encryption in transit: HTTPS/TLS for all backup traffic.
Data Isolation: Vaulted data isolated from production; no direct external access.
Azure RBAC: Role-based access control for backup/restore permissions.
CMK requires Azure Key Vault; enable before adding items to vault.

Soft Delete & Enhanced Protection

Soft Delete: Default enabled; 14-day retention on deleted backups (free).
Enhanced Soft Delete: Customize retention (1–99 days) and always-on protection.
Prevents accidental or malicious backup deletion.
Protects against ransomware & insider threats.
Recovery of soft-deleted items has no additional cost.

Cross-Region Restore (CRR)

Restore Azure VMs/databases from GRS vault to secondary region.
Enable at vault level (requires GRS replication type).
Replicated data available in secondary region within 48 hours.
No need to wait for Azure disaster declaration; immediate DR capability.
Supported for VMs, SQL, SAP HANA; incurs additional charges.

CRS cannot be reverted to GRS/LRS after protection starts.

Vault Quotas & Limits

Resource	Limit
Vaults per region/subscription	500
Azure VMs per vault	1,000
MARS agents per vault	50
MABS/DPM servers per vault	50
Total datasources (VMs+SQL+AFS)	2,000 (recommended)
Backup policies per vault	200
Recovery points per item	9,999

Policy creation/updates limited to 50 per 24 hours via ARM/PowerShell/CLI.

Backup Policy & Retention

Define schedule (daily, weekly, monthly, yearly).
Retention ranges: 7 days to 99 years (depending on frequency).
Incremental backups reduce storage costs & transfer time.
Multiple policies per vault for different workloads.
Policy changes apply to new recovery points; existing RPs retain old settings.

Monitoring & Alerts

Central dashboard for Backup & Site Recovery jobs.
Real-time alerts for backup failures, unexpected events.
Metrics and health monitoring; historical reports.
Azure Advisor recommendations for unprotected VMs (hourly).
Backup Alerts available via Azure Monitor, Business Continuity Center, or vault.

Recovery Point Objectives (RPO)

Backup Type	RPO	Use
Azure VM snapshot	Minutes	Operational backups
Scheduled daily	24 hours	General-purpose
SQL continuous log	Seconds	Databases (low RPO)
On-demand	N/A	Immediate snapshots

Azure Advisor Integration

Hourly recommendations for VMs without backups.
Identifies at-risk workloads for protection.
One-click backup enablement from recommendation.
Snooze/suppress recommendations as needed.
Supports High Availability, Security, Performance, Cost optimization.

CLI Example: Create & Enable Backup

# Create Recovery Services vault (GRS) az backup vault create -g MyRG -n MyVault \ --location eastus # Enable backup for Azure VM az backup protection enable-for-vm -g MyRG \ --vault-name MyVault --vm MyVM --policy-name DefaultPolicy # List protected items az backup item list -g MyRG --vault-name MyVault # Trigger on-demand backup az backup protection backup-now -g MyRG \ --vault-name MyVault --container-name MyVM \ --item-name MyVM --retain-until 2025-12-31 # Restore VM from recovery point az backup restore restore-disks -g MyRG \ --vault-name MyVault --container-name MyVM \ --item-name MyVM --rp-name RecoveryPoint1

Mode	Profile	Best For
Flexible	Standard Azure VMs	New workloads (default)
Uniform	Identical VMs	Legacy large-scale workloads

Feature	Flexible	Uniform
Standard VM APIs	Yes	No
Mix instance types	Yes	No
RBAC per VM	Yes	No
Azure Backup	Yes	No
Site Recovery	Yes	No
Fault domains	1–3	1–5

Type	Layer	Best For
Internal LB	L4	Backend pools
Public LB	L4	External traffic
App Gateway	L7	HTTP/HTTPS + WAF

Policy	Rollout	Use
Automatic	Batch	App can tolerate disruption
Rolling	Controlled	Gradual, managed updates
Manual	On-demand	Full control; explicit API calls