Azure Backup Fundamentals

Even in the cloud, data can be lost through accidental deletion, ransomware encryption, application bugs, or configuration errors. Cloud providers protect you from hardware failure but not from mistakes in your own account. Azure Backup is Microsoft's native, fully managed backup service that protects VMs, Azure Files shares, SQL databases running on VMs, Azure SQL Databases, and more — with zero infrastructure to manage.

A Recovery Services vault is the top-level management object for both Azure Backup and Azure Site Recovery. It stores backup data, holds backup policies, and provides a single pane of glass for monitoring backup jobs. Each vault is tied to a region — backup data stays in the same region as the vault unless you configure geo-redundant storage. You need at least one vault per region where you have workloads to protect.

A backup policy defines the schedule (when backups run — daily, weekly, hourly) and the retention rules (how long recovery points are kept — daily, weekly, monthly, yearly). Azure Backup supports Enhanced policies that allow multiple backups per day and longer-term YYYY/MM retention tiers. The policy is linked to each protected item independently so different VMs can have different schedules.

Enabling Azure Backup for a VM takes three steps: register the VM with the vault, create or assign a backup policy, and trigger the first backup. Azure Backup uses the VM Agent (pre-installed on all Azure Marketplace images) to coordinate application-consistent snapshots via Volume Shadow Copy Service (VSS) on Windows or pre/post scripts on Linux. No additional software installation is required for basic file-system-consistent VM backup.

Application-consistent backups quiesce the application (flush write buffers and freeze I/O) before taking the snapshot, ensuring the database or application can recover cleanly from the backup. Crash-consistent backups capture the disk state at a point in time without coordinating with the application — equivalent to pulling the power plug. For databases, always aim for application-consistent backups to avoid manual recovery steps after restore.

When creating a Recovery Services vault you choose the backup storage redundancy before protecting any items. Locally Redundant Storage (LRS) keeps three copies within one data centre — cheapest but single-region risk. Geo-Redundant Storage (GRS) replicates to a paired region — the default and recommended for most production workloads. Zone-Redundant Storage (ZRS) replicates across availability zones within the same region. You cannot change redundancy after protecting items.

Every backup and restore operation creates a backup job that you can track in the Recovery Services vault under the Backup Jobs blade. Each job shows its status (In Progress, Completed, Failed, Warning), start time, duration, and any error details. You can configure alert notifications via Azure Monitor to send email when a backup job fails. Azure Backup Center provides a unified cross-vault, cross-subscription monitoring view.

Soft delete is a vault-level security feature enabled by default that retains deleted backup data for 14 additional days at no extra cost. If an attacker or accidental deletion removes a backup item from the vault, the data is not immediately purged — it enters a soft-deleted state and can be undeleted. Soft delete is enabled by default on all new vaults and is strongly recommended as a defence against ransomware targeting backup infrastructure.

Azure Backup integrates natively with Azure Files to take share-level snapshots. Unlike VM backups that require a Recovery Services vault agent, Azure Files snapshots are pure storage-layer operations with no agent. You can schedule up to 200 snapshots per share and restore individual files or the entire share from any snapshot. The backup data stays within the storage account, making restores very fast.

In addition to scheduled backups, you can trigger an on-demand backup at any time — for example, before a major application change or patch deployment. On-demand recovery points have their own configurable retention independent of the schedule policy. Azure Backup Center is a unified management portal that provides a cross-subscription, cross-region view of all backup items, jobs, policies, and compliance status without switching between individual vaults.

Azure Backup pricing has two components: a protected instance fee (charged per VM or workload based on the front-end size of the data) and a backup storage fee (charged per GB of consumed storage). For small VMs (under 50 GB front-end), the protected instance fee is lower. Geo-redundant storage costs more than locally redundant storage. Cross-region restore (needed for geo-failover scenarios) incurs an additional data transfer charge.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: Recovery Services vaults are the management hub for Azure Backup and Site Recovery, backup policies define schedule and retention independently per protected item, and soft delete provides a 14-day safety net against accidental or malicious removal of backup data. Next up we explore how to restore data from Azure Backup in different recovery scenarios.