Vault type in Azure Backup aimed at newer workloads, for instance managed disks, Azure Blobs, AKS and Azure Database for PostgreSQL. Protecting Azure VMs, Azure Files or MARS backups requires a Recovery Services vault instead.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Backup vault in context, with comparison tables and the common traps.
Terms in this definition
- Azure Backup
Azure's backup service, which keeps recovery points, long-term retention included, in a Recovery Services vault. It restores data rather than failing workloads over, which is the job of Site Recovery.
- Managed disks
Block storage disks for VMs whose underlying storage accounts Azure looks after. The only redundancy choices are LRS and ZRS.
- AKS
Short for Azure Kubernetes Service, a managed Kubernetes offering that gives full control of clusters and node pools. Scaling uses the cluster autoscaler and Horizontal Pod Autoscaler; user sign-in is not built in.
- Azure Database for PostgreSQL
Azure's managed PostgreSQL. It grows by scaling up and by adding read replicas rather than multi-master writes; to spread writes horizontally you use its elastic clusters feature, based on Citus.
- Virtual machines
Infrastructure-as-a-service compute giving complete control of the operating system, making it a fit for lift-and-shift moves and for software relying on OS-level pieces like COM.
- Azure Files
Azure's managed file shares over SMB or NFS. There is no Archive tier, and a single encryption key applies across the whole storage account.
- Microsoft Azure Recovery Services agent
Usually installed on on-premises Windows machines, the MARS agent sends their files, folders and system state directly into a Recovery Services vault.
- Recovery Services vault
Where Azure Backup and Site Recovery keep their data; it offers soft delete, immutability and multi-user authorisation, but is the wrong choice for cheaply archiving files you already have.
Related terms
- Disk Backup Reader
Built-in role that must be granted on the source managed disk to the Backup vault's managed identity, letting Azure Disk Backup read the disk.
- Disk Snapshot Contributor
For Azure Disk Backup to create and clean up snapshots, the Backup vault's managed identity must hold this built-in role over the resource group where snapshots are kept.
- Resource Guard
Keeps, in a resource of its own, the permissions demanded by multi-user authorisation before sensitive backup vault operations can go ahead; putting it in another subscription or tenant is recommended.