VM & Compute Backup
Standard vs Enhanced policy · Instant restore · Restore options · Cross Region Restore
Practice questions for this topic →
Backup policies
| Standard policy | Enhanced policy | |
|---|---|---|
| Frequency | Once a day | As often as every 4 hours (hourly schedules) |
| Instant restore snapshots | Local | Zone-redundant (ZRS), up to 30 days in the snapshot tier |
| Trusted Launch, Premium SSD v2, Ultra Disk | Limited (Trusted Launch via CLI/PowerShell/REST only) | Supported |
| Switch back | — | Can't revert to Standard |
| Shared disks | — | Can be excluded while other disks are backed up |
How VM backup works
- A snapshot is taken and transferred to the vault with no impact on production. The first backup is a full backup; later ones transfer only changed blocks, with disks backed up in parallel.
- Consistency: app-consistent (Windows uses VSS through the VMSnapshot extension), file-consistent (Linux; app-consistent needs your pre/post scripts), or agentless crash-consistent. A shut-down VM still backs up, with a crash-consistent point.
- SQL Server and SAP HANA in VMs use workload-aware backup with a 15-minute RPO and per-database restore.
- On-demand backups keep for 30 days by default from the portal (you can set retention). You can cancel a job in the 'Taking snapshot' state but not while data is transferring. The Configure Backup wizard lists only VMs in the vault's region that aren't already backed up.
- Azure Disk Encryption VMs still back up; Microsoft notes ADE retirement is planned for Sep 2028, with encryption at host as the migration target.
Restore options
| Option | Use for |
|---|---|
| Create new VM | Quick basic VM from a recovery point (same region) |
| Restore disks | Customize the VM with a generated template or attach disks elsewhere |
| Replace existing disks | Roll an existing VM back in place (VM must exist; snapshot taken first; original disks kept) |
| File recovery | Mount a recovery point and copy individual files |
| Cross Region Restore (CRR) | Restore in the paired region at any time (GRS vault with CRR enabled; secondary data lags slightly) |
| Cross Subscription Restore | Restore into another subscription |
Recovery points live in two tiers: the snapshot tier (instant restore, faster) and the vault tier. Vault replication options: LRS, GRS (default, recommended), ZRS.
Exam Tips
Tick each tip once you can answer it without looking.
“VM backups needed every 4 hours (RPO 4 h)” → Enhanced policy.
“Back up a VM with Premium SSD v2 or Ultra Disk” → Enhanced policy. Trap: Standard policy doesn't support them.
“Restore a single deleted file from a VM backup” → File recovery (item-level restore).
“Restore VM backups in the paired region without waiting for Microsoft to declare a disaster” → Cross Region Restore (GRS vault).
“Fastest VM restore” → Instant restore from snapshot tier.
“Application-consistent backup of SQL Server inside a VM with 15-min log backups” → Azure Backup for SQL Server in Azure VM (workload backup). Trap: A plain VM backup is daily/crash or app-consistent only.
“Back up AKS persistent volumes and cluster state” → Azure Backup for AKS (Backup vault).
“Kinds of VM backup consistency” → App-consistent (VSS or scripts), file-consistent, or agentless crash-consistent. Trap: A shut-down VM still backs up with a crash-consistent point.
“How a VM backup runs” → Snapshot, then transfer of changed blocks to the vault; first backup is full; no production impact. Trap: SQL Server in a VM uses workload backup with a 15-minute RPO.
“On-demand VM backup retention” → 30 days by default from the portal; you can set it. Trap: Backup cost is separate from the VM cost.
“Cancelling a VM backup job” → Possible while taking the snapshot; not during data transfer. Trap: The wizard lists only VMs in the vault's region not already protected.
“Azure Disk Encryption and Azure Backup” → Backups continue; Microsoft notes ADE retires Sep 2028 (move to encryption at host). Trap: Give Azure Backup Key Vault access if you enable ADE later.