Azure Backup Recovery
Integration Context Contract
| Workflow |
tenantId |
subscriptionId |
environmentCloud |
principalType |
scopesOrRoles |
| Azure Backup Recovery operations |
required |
required |
AzureCloud* |
service-principal or delegated-user |
Backup Reader, Site Recovery Contributor, Reader |
- Use sovereign cloud values from the canonical contract when applicable.
Fail fast before API calls when required context is missing or malformed. Redact tenant, subscription, and object identifiers.
Command Surface
| Command |
Purpose |
backup-recovery-setup |
Deterministic workflow for backup recovery setup. |
backup-job-health |
Deterministic workflow for backup job health. |
backup-restore-drill |
Deterministic workflow for backup restore drill. |
backup-recovery-plan-audit |
Deterministic workflow for backup recovery plan audit. |
backup-cross-region-check |
Deterministic workflow for backup cross region check. |
Guardrails
- Validate context schema and minimum grants before any API call.
- Run read-only discovery first whenever possible.
- Require explicit confirmation for destructive actions.
- Re-query and verify post-action state.
- Return structured, redacted output.
Azure CLI Reference
Recovery Services Vault
# Create vault
az backup vault create --name <vault-name> --resource-group <rg> --location <region>
# Show vault details
az backup vault show --name <vault> --resource-group <rg>
# List vaults in resource group
az backup vault list --resource-group <rg> --output table
# Delete vault
az backup vault delete --name <vault> --resource-group <rg> --yes --force
# Set vault storage redundancy (GeoRedundant | LocallyRedundant | ZoneRedundant)
az backup vault backup-properties set --name <vault> --resource-group <rg> --backup-storage-redundancy GeoRedundant
# Show vault backup properties
az backup vault backup-properties show --name <vault> --resource-group <rg>
Backup Policies
# Create VM backup policy from JSON
az backup policy create --vault-name <vault> --resource-group <rg> --name <policy-name> --policy @vm-backup-policy.json --backup-management-type AzureIaasVM
# List all policies
az backup policy list --vault-name <vault> --resource-group <rg> --output table
# List policies by management type
az backup policy list --vault-name <vault> --resource-group <rg> --backup-management-type AzureIaasVM --output table
# Show policy details
az backup policy show --vault-name <vault> --resource-group <rg> --name <policy-name>
# Update policy from JSON
az backup policy set --vault-name <vault> --resource-group <rg> --policy @updated-policy.json --name <policy-name>
# Delete policy
az backup policy delete --vault-name <vault> --resource-group <rg> --name <policy-name>
# Get default VM policy
az backup policy get-default-for-vm --vault-name <vault> --resource-group <rg>
VM Backup
# Enable backup for VM
az backup protection enable-for-vm --vault-name <vault> --resource-group <rg> --vm <vm-name> --policy-name <policy-name>
# Trigger on-demand backup
az backup protection backup-now --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --backup-management-type AzureIaasVM --retain-until 2026-04-10
# List protected items
az backup item list --vault-name <vault> --resource-group <rg> --output table
# List VM protected items only
az backup item list --vault-name <vault> --resource-group <rg> --backup-management-type AzureIaasVM --output table
# Show protected item details
az backup item show --vault-name <vault> --resource-group <rg> --container-name <container> --name <vm-name> --backup-management-type AzureIaasVM
# Disable protection (keep data)
az backup protection disable --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --backup-management-type AzureIaasVM
# Disable protection (delete data)
az backup protection disable --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --backup-management-type AzureIaasVM --delete-backup-data true --yes
Backup Jobs
# List all backup jobs
az backup job list --vault-name <vault> --resource-group <rg> --output table
# List failed jobs
az backup job list --vault-name <vault> --resource-group <rg> --status Failed --output table
# List jobs in date range
az backup job list --vault-name <vault> --resource-group <rg> --start-date 2026-03-01 --end-date 2026-03-10 --output table
# Show job details
az backup job show --vault-name <vault> --resource-group <rg> --name <job-id>
# Wait for job completion
az backup job wait --vault-name <vault> --resource-group <rg> --name <job-id>
# Stop a running job
az backup job stop --vault-name <vault> --resource-group <rg> --name <job-id>
Restore Operations
# List recovery points
az backup recoverypoint list --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --backup-management-type AzureIaasVM --output table
# Show recovery point details
az backup recoverypoint show --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --backup-management-type AzureIaasVM --name <rp-name>
# Restore VM disks to storage account
az backup restore restore-disks --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --rp-name <rp-name> --storage-account <sa-name> --target-resource-group <target-rg>
# Restore disks to staging storage account
az backup restore restore-disks --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --rp-name <rp-name> --storage-account <sa-name> --restore-to-staging-storage-account true --target-resource-group <target-rg>
# Mount recovery point for file-level restore
az backup restore files mount-rp --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --rp-name <rp-name>
# Unmount recovery point after file restore
az backup restore files unmount-rp --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --rp-name <rp-name>
# Cross-region restore (requires CRR enabled on vault)
az backup restore restore-disks --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --rp-name <rp-name> --storage-account <sa-name> --target-resource-group <target-rg> --use-secondary-region
Backup Containers
# List containers
az backup container list --vault-name <vault> --resource-group <rg> --backup-management-type AzureIaasVM --output table
# Show container details
az backup container show --vault-name <vault> --resource-group <rg> --name <container-name> --backup-management-type AzureIaasVM
# Register container for SQL/HANA workloads
az backup container register --vault-name <vault> --resource-group <rg> --backup-management-type AzureWorkload --workload-type SAPHANA --resource-id <vm-resource-id>
# Unregister container
az backup container unregister --vault-name <vault> --resource-group <rg> --container-name <container> --backup-management-type AzureIaasVM --yes
SQL and File Share Backup
# Enable SQL database backup
az backup protection enable-for-azurewl --vault-name <vault> --resource-group <rg> --policy-name <policy> --protectable-item-name <db-name> --protectable-item-type SQLDataBase --server-name <server> --workload-type MSSQL
# Enable Azure File Share backup
az backup protection enable-for-azurefileshare --vault-name <vault> --resource-group <rg> --policy-name <policy> --storage-account <sa-name> --azure-file-share <share-name>
# Restore file share
az backup restore restore-azurefileshare --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <share-name> --rp-name <rp-name> --resolve-conflict Overwrite --restore-mode OriginalLocation
Azure Site Recovery
# Create Recovery Services vault for ASR
az backup vault create --name <vault-name> --resource-group <rg> --location <region>
# Enable replication for VM (via REST)
az rest --method PUT \
--url "https://management.azure.com/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.RecoveryServices/vaults/<vault>/replicationFabrics/<fabric>/replicationProtectionContainers/<container>/replicationProtectedItems/<item>?api-version=2023-08-01" \
--body @enable-replication.json
# List replicated items
az rest --method GET \
--url "https://management.azure.com/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.RecoveryServices/vaults/<vault>/replicationProtectedItems?api-version=2023-08-01" \
--query "value[].{Name:name, Status:properties.protectionState, Health:properties.replicationHealth}"
# Test failover
az rest --method POST \
--url "https://management.azure.com/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.RecoveryServices/vaults/<vault>/replicationFabrics/<fabric>/replicationProtectionContainers/<container>/replicationProtectedItems/<item>/testFailover?api-version=2023-08-01" \
--body '{"properties":{"failoverDirection":"PrimaryToRecovery","networkId":"<vnet-resource-id>","networkType":"VmNetworkAsInput"}}'
# Cleanup test failover
az rest --method POST \
--url "https://management.azure.com/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.RecoveryServices/vaults/<vault>/replicationFabrics/<fabric>/replicationProtectionContainers/<container>/replicationProtectedItems/<item>/testFailoverCleanup?api-version=2023-08-01" \
--body '{"properties":{"comments":"Test complete"}}'
# Planned failover
az rest --method POST \
--url "https://management.azure.com/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.RecoveryServices/vaults/<vault>/replicationFabrics/<fabric>/replicationProtectionContainers/<container>/replicationProtectedItems/<item>/plannedFailover?api-version=2023-08-01" \
--body '{"properties":{"failoverDirection":"PrimaryToRecovery"}}'
# List recovery plans
az rest --method GET \
--url "https://management.azure.com/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.RecoveryServices/vaults/<vault>/replicationRecoveryPlans?api-version=2023-08-01"
# Create or update recovery plan
az rest --method PUT \
--url "https://management.azure.com/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.RecoveryServices/vaults/<vault>/replicationRecoveryPlans/<plan-name>?api-version=2023-08-01" \
--body @recovery-plan.json
Monitoring and Diagnostics
# Show backup alerts
az backup alert show --vault-name <vault> --resource-group <rg>
# Create diagnostic settings for vault
az monitor diagnostic-settings create \
--resource "/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.RecoveryServices/vaults/<vault>" \
--name "backup-diag" \
--workspace <workspace-id> \
--logs '[{"categoryGroup":"allLogs","enabled":true}]' \
--metrics '[{"category":"AllMetrics","enabled":true}]'
# Show vault usage summary
az backup vault show --name <vault> --resource-group <rg> --query "{Name:name,ProtectedItems:properties.privateEndpointStateForBackup,StorageType:properties.storageModelType}"
Progressive Disclosure - Reference Files
thelobbi