Contact
All systems System Coming soon

Backup policies for Azure

A catalogue of the Azure resource types in an environment: which are backed up and which could be. Backup is switched on per type by an Azure Policy assignment that can be enabled or disabled, and Azure Backup does the backups.

This system is in development. Until it is released, we offer backup design, restore tests and recovery procedures as the Backup and recovery service.

Ask about this

What you get

  • A catalogue of the Azure resource types in the environment, showing which are backed up and which could be
  • An Azure Policy assignment per resource type that switches backup on and can be enabled or disabled
  • Backup schedule and retention taken from a backup policy in the vault: the one selected in the assignment, or the default policy of a new vault
  • Other policies on request, such as Recovery Services vault backup policies or audit policies that report resources without backup

How it works

  1. 01

    Catalogue the resource types

    The catalogue lists the Azure resource types in the environment and shows which are backed up and which could be. Virtual machines have built-in Azure Policy definitions for backup. Those for Azure file shares, blobs and managed disks, and for the backup extension on AKS clusters, are still in preview.

  2. 02

    Choose a vault model

    Virtual machines are backed up either to an existing Recovery Services vault in the same region or to a new vault per resource group with a default policy. The first is a central model, for a team that manages backups across subscriptions. The second is application-centric. Tags include or exclude individual VMs.

  3. 03

    Switch backup on per type

    Built-in Azure Policy definitions with the DeployIfNotExists effect configure Azure Backup. New VMs in scope are configured automatically, and existing VMs are covered with a remediation task. Following Microsoft's advice, the VM policy is not assigned to more than 200 VMs at once, because backups can then start hours late.

  4. 04

    Set schedule and retention

    Backup schedule and retention come from a backup policy in the vault. An assignment to an existing vault selects that policy; a new vault uses a default policy. New Recovery Services vault backup policies are added on request.

  5. 05

    Enforce vault settings on request

    Built-in Azure Policy definitions for Recovery Services vaults can disable public network access, configure private endpoints, restrict storage redundancy and send diagnostic logs to Log Analytics.

Problems it solves

  • ProblemNew virtual machines are created without backup, and the gap shows only when something has to be restored.

    SolutionA built-in policy with the DeployIfNotExists effect configures Azure Backup for each new VM in scope. Existing VMs are covered with a remediation task.

  • ProblemNobody can say which resources are protected and which are not.

    SolutionThe catalogue shows per resource type what is backed up and what could be. On request, audit policies such as "Azure Backup should be enabled for Virtual Machines" report the resources without backup.

  • ProblemRetention is changed by hand in each vault, so the same kind of data is kept for different lengths of time.

    SolutionWith an existing vault, the assignment selects one backup policy, so every resource it configures gets the same schedule and retention.

  • ProblemEach subscription was set up differently, so whether a resource is backed up depends on who created it.

    SolutionThe same built-in policy definitions are assigned in every subscription and region in scope, with tags to include or exclude VMs, so each resource type follows the same rules.

  • ProblemVaults were configured one by one: some accept public network access, others send no diagnostic logs.

    SolutionBuilt-in Azure Policy definitions for vaults can disable public network access, configure private endpoints and send diagnostic logs to Log Analytics. A further definition blocks new vaults with a storage redundancy that is not allowed.

What it covers

  • For exampleAzure Virtual Machines, Azure Files, Azure Blob Storage, Azure managed disks
  • For exampleAzure Policy, Azure Backup
  • Remediation for existing resources
  • For exampleRecovery Services vault, Backup vault
  • Central or per-resource-group vaults
  • Include or exclude VMs by tag
  • Coverage audit for resources without backup
  • For examplePrivate Endpoints, Log Analytics
Typical scope

For Azure environments, in one subscription or across several. Backup is switched on only for the resource types chosen in the catalogue.

Next step

Send a short description of what you need and the systems involved. We reply with proposed next steps.

Ask about this