Back up and recover with Azure Backup and Site Recovery — AZ-104 Hoofdstuk 13

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Back-up en herstel met Azure Backup en Site Recovery

Choose a vault

Backups are stored in a vault. There are two kinds.

Vault	Protects
Recovery Services vault	Azure VMs, Azure Files, SQL / SAP HANA in VMs, on-premises (MARS agent); also Site Recovery
Backup vault	Azure disks, blobs, PostgreSQL, AKS

$az backup vault create -g rg-bkp -n rsv-prod -l westeurope
$az backup vault backup-properties set -g rg-bkp -n rsv-prod --backup-storage-redundancy GeoRedundant --cross-region-restore-flag true

Onthoud

Set the storage redundancy (LRS, ZRS, GRS) before the first backup — it can not change later.

13.2

Back up a VM

Enable protection with a policy (when and how long). Azure takes snapshots, then copies them to the vault.

$az backup protection enable-for-vm -g rg-bkp -v rsv-prod --vm VM_ID --policy-name DefaultPolicy
$az backup protection backup-now -g rg-bkp -v rsv-prod -c vm-web1 -i vm-web1 --backup-management-type AzureIaasVM --retain-until 30-11-2026
$az backup job list -g rg-bkp -v rsv-prod -o table

Policy part	Example
Frequency	Daily at 02:00 (Enhanced policy: every 4 hours)
Instant restore	Snapshots kept 2 – 5 days for fast restores
Retention	30 daily, 12 weekly, 12 monthly, 5 yearly points

13.3

Restore from a backup

Several restore options, from one file to a whole new VM.

Option	Result
Create new VM	A new VM from the restore point
Restore disks	Disks only; attach them or build a VM yourself
Replace existing	Replace the disks of the existing VM
File recovery	Mount the restore point and copy single files
Cross-region restore	Restore in the paired region (GRS vault)

$az backup recoverypoint list -g rg-bkp -v rsv-prod -c vm-web1 -i vm-web1 --backup-management-type AzureIaasVM -o table
$az backup restore restore-disks -g rg-bkp -v rsv-prod -c vm-web1 -i vm-web1 -r RECOVERY_POINT --storage-account stbkprestore --target-resource-group rg-restore

Examentip

A backup is only proven by a restore. Test one restore every month and write down how long it took.

13.4

Back up file shares and blobs

Azure Files backup uses share snapshots managed by the vault. Blob backup uses operational backup (in the account) or vaulted backup (copied to the vault).

$az backup protection enable-for-azurefileshare -g rg-bkp -v rsv-prod --storage-account stshop2026 --azure-file-share team --policy-name FileSharePolicy

13.5

Protect backups from attackers

Ransomware tries to delete backups first. Turn on the protections.

Soft delete: deleted backup data stays 14 days (or longer with enhanced soft delete).
Immutable vault: nobody can shorten retention or delete points before they expire.
Multi-user authorization: critical actions need approval from a second person (Resource Guard).
RBAC: only a few people get Backup Contributor.

13.6

Replicate VMs with Site Recovery

Site Recovery copies VM disks to another region all the time. In a disaster you fail over and run the VMs there.

In the Recovery Services vault (in the target region): Site Recovery → Enable replication for the VMs.
Choose the target region, network, and the replication policy (recovery point retention, app-consistent snapshots).
Test failover into an isolated test VNet — no impact on production.
In a real disaster: Failover, then Commit; later Re-protect and fail back.

Term	Meaning
RPO	How much data you may lose (minutes of changes)
RTO	How long until the service runs again
Recovery plan	The order and scripts of a failover for a multi-tier app

Alle commando's in dit hoofdstuk

az