You're a great admin... on-prem. Now, become a great admin in the cloud and prove it by passing the Microsoft Certified: Azure Administrator Associate exam!
Gauge your current knowledge
Gauge your current knowledge
An Azure Backup strategy relies on a backup policy to define when backups occur and how long they are kept. This policy is scoped to a single recovery vault and consists of a schedule (daily or weekly) and retention rules (daily, weekly, monthly, or yearly). When business needs change, modifying these policies impacts existing backups: extending retention applies the new lifespan to existing recovery points, while reducing it marks older points for deletion during the next cleanup job. Administrators can also run an on-demand backup to capture a resource's state outside the standard schedule, which uses its own custom retention rules instead of the scheduled policy.
When a protected resource is decommissioned or no longer needs active backups, administrators must choose how to stop protection. Choosing stop protection and retain backup data pauses future backup runs but preserves all existing recovery points for audit or compliance requirements. Alternatively, choosing stop protection and delete backup data immediately stops future jobs and deletes all existing recovery points, making data recovery impossible.
Azure Backup secures recovery data by encrypting it at rest and in transit using Microsoft-managed or customer-managed keys. Access to vaults is restricted using role-based access control (RBAC) to enforce the principle of least privilege among administrators. Additionally, soft delete is enabled to retain deleted backup data for 14 days, safeguarding against accidental or malicious deletions. Operational health is tracked using built-in monitoring tools, Backup Explorer for granular analysis, and Azure Monitor integrated with Log Analytics for long-term historical insights.
To shield backup data from ransomware and unauthorized deletions, administrators can configure advanced policy safeguards. Enabling immutability on a vault locks recovery points, preventing anyone from altering or deleting them before their pre-defined expiration dates. Access control is managed through specific RBAC roles, including Backup Contributor for managing backups, Backup Operator for executing jobs, and Backup Reader for viewing status. These built-in roles ensure clear segregation of duties across the IT organization.
Deploying backup policies at scale requires automated governance to maintain consistent compliance. Administrators use Azure Policy with the deployIfNotExists effect to automatically configure backups for new resources, such as virtual machines, and link them to a central vault. It is crucial to design retention periods carefully because Azure Backup does not support the selective deletion of individual recovery points. Any changes to a policy apply systematically across all associated resources, where reducing retention marks old points for automated pruning.
For maximum security, organizations can implement multi-user authorization (MUA), which relies on a Resource Guard to mandate an external approval step before critical changes can be made, such as disabling soft delete. Data security is further enhanced by utilizing customer-managed keys (CMK) to maintain direct control over the encryption keys protecting the vault. Operational consistency is maintained by periodically resuming protection on paused workloads, which automatically re-evaluates current retention rules and removes expired recovery points. Finally, administrators must perform regular test restores to validate that actual recovery times align with organizational Recovery Point Objective (RPO) and Recovery Time Objective (RTO) targets.
Defining backup parameters involves matching the backup frequency and retention rules to the criticality of each workload. Mission-critical systems leverage enhanced backup policies to run multiple daily backups, thereby minimizing potential data loss and maintaining a low RPO. While short-term retention handles immediate recovery needs, long-term retention rules keep data for months or years to satisfy regulatory compliance. To manage costs, older recovery points in these long-term retention tiers can be moved automatically to an archive tier.
The protection scope outlines which resources are governed by specific backup policies, a boundary heavily influenced by overall vault design. Best practices dictate segregating workloads across multiple recovery vaults based on region, department, workload type, or environment boundaries to isolate risk and enforce RBAC. Because a single vault has scalability limits, such as a maximum of 1,000 virtual machines, large environments must distribute resources across several vaults. To retain administrative visibility, operations teams use Backup Center as a unified management plane to monitor and govern all backup assets across these distributed vaults.
StudyCerts
StudyCerts