You're a great admin... on-prem. Now, become a great admin in the cloud and prove it by passing the Microsoft Certified: Azure Administrator Associate exam!
A backup policy is the rulebook for your backups. It defines how often backups are taken (the schedule) and how long they are kept (retention). You can manage both operational backups, which are continuous and have no schedule, and vaulted backups, which follow a defined schedule, within a single policy. For vaulted backups, you choose between daily or weekly schedules and set retention rules, often using a structure like grandparent-parent-child to keep some backups longer than others. Retention can be set for up to 10 years to meet organizational or legal requirements.
To apply these policies, you first need a Backup vault. This vault is the storage location for all your backup data. You create it and then link it to your storage accounts. When configuring backup, you select which specific storage accounts and even which containers inside them you want to protect. Azure Backup will check that you have the right permissions and that the setup is valid before enabling protection. An important security feature is immutable vaults, which lock recovery points so they cannot be deleted before their expiry date, protecting against threats like ransomware.
An Azure Recovery Services vault is a central management resource for backup and disaster recovery. It stores backup data, recovery points, and replication information for resources like Azure Virtual Machines and Azure Files. Creating this vault is the first step in building a data protection strategy. You must specify a subscription, a resource group for organization, a unique name, and, most critically, the region. The vault must be in the same region as the resources it will protect.
You can create the vault through the Azure Portal, PowerShell, ARM templates, or the REST API. A key decision during creation is selecting the storage redundancy, which determines how your backup data is copied for safety. Geo-redundant storage (GRS) replicates data to a paired Azure region for maximum durability and is the default. Locally redundant storage (LRS) keeps copies within a single data center and is lower cost. Zone-redundant storage (ZRS) replicates across availability zones within one region. This setting must be chosen before any backups are configured, as it becomes locked afterward.
A system architecture diagram showing how a Backup vault replicates data using Locally Redundant Storage (LRS), Zone-Redundant Storage (ZRS), and Geo-Redundant Storage (GRS), along with their respective data center, availability zone, and paired region targets.
The vault also supports advanced restore capabilities. Cross Region Restore (CRR), available for GRS vaults, lets you restore data directly into the secondary paired region without waiting for a disaster declaration. Cross Subscription Restore allows moving restored data to a different subscription within the same tenant. For security, features like Soft Delete (which temporarily retains deleted backups) and Immutable Vaults can be enabled, and you can use customer-managed keys for encryption instead of the default platform-managed keys.
Advanced security for a Backup vault involves enabling features that protect backups from both accidents and attacks. Soft delete is a safety net that retains deleted backup data for a period (14 days by default), allowing recovery if something is removed by mistake or maliciously. Immutable vaults take this further by making it impossible to delete any recovery point before its scheduled expiration date, a crucial defense against ransomware. Once enabled, these features can often be made irreversible.
The storage replication type you selected when creating the vault (LRS, ZRS, or GRS) is foundational for data durability and enables certain recovery features. For example, Cross Region Restore (CRR) is only available if you chose Geo-redundant storage (GRS). CRR allows you to restore data directly into the secondary, paired Azure region, which is vital for compliance testing or regional disaster recovery without declaring a full Azure outage. Enabling CRR has a cost and can take up to 48 hours to become active.
Security is also managed through access and encryption. Azure Role-Based Access Control (RBAC) limits who can perform operations on the vault. Encryption at rest uses Microsoft-managed keys by default, but you can use customer-managed keys (CMK) for greater control. Other features like Multi-User Authorization require additional approvals for critical tasks. When planning, consider how the vault's configuration affects your Recovery Point Objective (RPO) and Recovery Time Objective (RTO). For instance, with GRS, the RPO for restoring to a secondary region might be up to 36 hours due to replication latency.
Prepare and test your skills
Prepare and test your skills
An Azure Recovery Services vault supports Locally redundant storage (LRS), Zone-redundant storage (ZRS), and Geo-redundant storage (GRS), which is the default option. The storage redundancy setting must be selected before any backups are configured, as it becomes locked afterward.
Cross Region Restore (CRR) allows backup data to be restored directly into a secondary paired Azure region without waiting for a disaster declaration. It is available only for vaults configured with Geo-redundant storage (GRS) and can take up to 48 hours to become active.
Immutable vaults protect backup data by locking recovery points so they cannot be deleted before their scheduled expiration date. This capability provides a safeguard against accidental deletion and malicious threats like ransomware, and once enabled, it can often be made irreversible.
StudyCerts
StudyCerts