Why change
Tape and on-prem disk backups are slow to restore, hard to test and often reachable by the same attacker that encrypts production. A cloud vault with immutability and separate access is a strong ransomware control and removes tape logistics.
1. Map workloads to protection
| Workload | Azure Backup option |
|---|---|
| Azure VMs | VM backup (Enhanced policy for multiple daily points) |
| SQL Server / SAP HANA in Azure VMs | Workload backup inside the VM, log backups every 15 minutes or so |
| Azure Files, Blobs, Disks, PostgreSQL Flexible | Native vaulted or operational backup |
| On-prem file and folder | MARS agent directly to the vault |
| On-prem VMs, SQL, Exchange, SharePoint | Azure Backup Server (MABS) or DPM with online protection |
| Long-retention archives | Archive tier for eligible recovery points |
2. Design the vault
az backup vault create -g rg-backup -n rsv-prod -l westeurope
az backup vault backup-properties set -g rg-backup -n rsv-prod --backup-storage-redundancy GeoRedundant --cross-region-restore-flag true
Set storage redundancy before protecting the first item; it can't be changed after.
Security settings (portal → vault → Properties):
- Soft delete with an extended retention period (always-on soft delete prevents disabling it).
- Immutability — enable, test, then lock it so recovery points can't be deleted before expiry.
- Multi-user authorisation (MUA) with Resource Guard in a separate subscription owned by security, so destructive operations need a second approver.
Caution
Locked immutability cannot be undone. Get retention right before locking — you'll pay for every point until it expires.
3. Policies that match your old retention
Translate the tape scheme (for example daily 30 days, weekly 12 weeks, monthly 12 months, yearly 7 years) into backup policies. Use the archive tier for monthly/yearly points where restore time allows.
4. On-premises
- MARS agent for file servers that are not yet migrated: install, register with vault credentials, set a passphrase and store it in a separate safe place (Key Vault in another subscription).
- MABS for application-aware backups: short-term on local disk for fast restores, long-term online in the vault.
5. Retire tapes safely
- Keep existing tapes until their retention expires; record which tape holds which period.
- Stop new tape jobs only after the first full vault backups and a successful restore test.
- Don't migrate old tape data unless legal requirements say so — it's slow and costly.
6. Prove restores
Quarterly restore tests per workload type: a file, a full VM to an isolated network, a database to a point in time. Record the time each takes against the RTO.
Checklist
- Every workload mapped to a protection method and policy
- Vault redundancy set before first item
- Soft delete, immutability (locked) and MUA configured
- Backup alerts routed to on-call
- Restore tests scheduled; tapes retired on schedule