Home / Azure

AzureRunbookIntermediate

Restoring an Azure VM from Azure Backup: files, disks or the whole VM

Pick the right restore type for the customer's request, run it from the portal or CLI, and avoid the IP, extension and domain-join problems that follow.

Deepak Bhardwaj3 min read

Applies toAzure Backup (Recovery Services vault), Azure VMs with managed disks

Choose the restore type

Customer request Restore type Downtime
"I deleted a file or folder" File recovery (mount the recovery point as a drive) None
"The data disk is corrupted" Restore disks, then attach the restored disk Minutes
"The VM is broken, put it back as it was yesterday" Replace existing (OS and data disks swapped) VM restarts
"Give me a copy to compare or test" Create new VM None on the original

Find the recovery points

VAULT=rsv-prod; RG=rg-backup
CONTAINER=$(az backup container list -g $RG -v $VAULT --backup-management-type AzureIaasVM --query "[?properties.friendlyName=='vm-app-01'].name" -o tsv)
ITEM=$(az backup item list -g $RG -v $VAULT -c $CONTAINER --query "[0].name" -o tsv)
az backup recoverypoint list -g $RG -v $VAULT -c $CONTAINER -i $ITEM \
  --query "[].{name:name, time:properties.recoveryPointTime, type:properties.recoveryPointType}" -o table

File recovery (most common)

  1. Portal: Backup items → the VM → File Recovery, choose a recovery point, and download the script.
  2. Run the script on a machine with the same or a compatible OS, ideally the original VM. It mounts the recovery point's volumes over iSCSI.
  3. Copy the files out, then select Unmount disks. The mount expires after 12 hours anyway.

Tip

The machine running the script needs outbound access to Azure (port 3260 and the Backup service). Behind a strict proxy, run it from another VM in the same VNet.

Restore disks with the CLI

az backup restore restore-disks -g $RG -v $VAULT -c $CONTAINER -i $ITEM \
  --rp-name <recovery-point-name> \
  --storage-account stbackupstaging \
  --target-resource-group rg-restore
az backup job list -g $RG -v $VAULT --query "[?properties.status=='InProgress']" -o table

The managed disks are created in rg-restore. Attach the one you need to the VM or to a recovery VM.

Problems after a restore

  • New VM gets a different IP. Set a static private IP on the NIC, or update DNS and the load balancer.
  • Domain trust broken (Windows, "trust relationship failed"). This happens when the restore point is older than the machine account password rotation (30 days by default). Fix: Test-ComputerSecureChannel -Repair -Credential (Get-Credential), or rejoin the domain.
  • Extensions missing. Reinstall monitoring and AV extensions. Restores don't always carry them over.
  • Duplicate machine on the network. A restored copy running next to the original can clash on hostname and SID-based services. Keep it isolated or rename it.

Prevent surprises

  • Do a restore test every quarter and record how long it took (your real RTO).
  • Use Cross Region Restore on GRS vaults for regional DR.
  • Turn on soft delete and immutability on the vault to protect backups from ransomware and accidental deletion.

Related fixes