In one sentence. Backup copies a VM, a file share or a database into a locked store called a vault, on a timetable you set, and keeps the copies for as long as you say. When something is lost you restore from a chosen night. Azure now has two vault types; the exam asks which one takes which workload.
| Recovery Services vault | Backup vault | |
|---|---|---|
| Create at | Recovery Services vaults › + Create | Backup center › Vault › + Vault › Backup vault |
| Protects | Azure VMs, Azure Files shares, SQL Server and SAP HANA running in VMs, on-prem Windows files/folders/system state via the MARS agent, on-prem Hyper-V/VMware via Azure Backup Server (MABS) or DPM | Azure Disks, Azure Blobs (operational and vaulted), Azure Database for PostgreSQL, AKS |
| Also hosts | Azure Site Recovery | Backup only |
| Storage redundancy | LRS / ZRS / GRS; cross-region restore needs GRS | LRS / ZRS / GRS |
You, the admin: back up VM-SQL1 nightly, keep 30 days, be able to restore in Melbourne
- Create vault RSV-Prod in Australia East (must match the VM's region and subscription). Under Properties › Backup Configuration choose Geo-redundant and enable Cross Region Restore; do this before the first backup.
- RSV-Prod › Backup › Azure › Virtual machine › Backup. Policy: create "Daily-22h": Enhanced policy (hourly points possible) or Standard; daily at 22:00; retain daily 30 days, weekly 12, monthly 12, yearly 7. Select VM-SQL1. Enable backup.
- The first run is a full copy; later runs send only changed blocks. Windows VMs get application-consistent points via VSS; Linux gets file-consistent unless you add pre/post scripts.
- Check jobs and alerts in Backup center (now Business Continuity Center), the single pane for every vault. Send vault diagnostics to a Log Analytics workspace for Backup reports.
How VM backup works
- Create a vault in the VM's region and subscriptionRecovery Services vault; choose redundancy (GRS for cross-region restore) before the first backup.
- Create a policySchedule (daily 22:00) and retention (30 daily, 12 weekly, 12 monthly, 7 yearly points).
- Enable backup on the VMFirst run is a full copy, later runs send only changed blocks.
- Restore when neededNew VM, disks only, replace disks, or a single file via File Recovery.
Restoring
| Need | Option (Backup items › VM › Restore VM / File Recovery) |
|---|---|
| Bring back the whole server as it was | Create new VM from the restore point |
| Rebuild with different settings or in another region | Restore disks to a storage account, then build the VM yourself (with cross-region restore, pick the paired region) |
| Keep the VM, roll its disks back | Replace existing disks |
| Just one deleted file | File Recovery: download a script, run it on any machine, the restore point mounts as a drive, copy the file |
- Soft delete keeps backup data for 14 days after you stop protection and delete; on by default, protects against ransomware deleting your backups. Immutable vault and multi-user authorisation (Resource Guard) go further.
- Stop backup offers Retain data (keep the points, stop the schedule) or Delete data. A vault holding data cannot be deleted.
- A VM belongs to one vault at a time; move it by stopping backup first.
- Azure Files: backed up as share snapshots inside the storage account (operational tier) or copied to the vault (vaulted tier); restore a file or the whole share.
- MARS agent: download from the vault, install on a Windows server or PC, register with the vault credentials file, pick folders and system state, up to three backups a day. Windows only; no apps.
Trap wording. "Disks, Blobs, PostgreSQL, AKS" = Backup vault. "VMs, Files, SQL in VM, MARS" = Recovery Services vault. "Vault in another region cannot see the VM" = by design. "One file" = File Recovery. "Restore in the paired region" = GRS + cross-region restore set before the first backup.