← Azure projects

Azure · Backup Design

Azure Backup Immutable Vault

Protect Azure recovery points from accidental or malicious deletion with immutable vault controls, separated administration, policy-driven retention, and tested restores.

PlatformAzure
DomainResilience
LevelIntermediate
Last reviewed2026-09-19
Use whenProtect Azure recovery points from accidental or malicious deletion while maintaining predictable retention and restore operations.
Key decisionLock only after retention is understood
Primary servicesAzure Backup · Recovery Services vault · Backup vault
Cost focusProtected instance size and type
On this page

Building blocks

Azure BackupRecovery Services vaultBackup vaultImmutable vaultAzure RBACAzure Monitor

Design goal

Make backup deletion materially harder for compromised or over-privileged identities while preserving a recovery process that can meet the required RPO and RTO.

Success criteria

  • Apply policy-based backup and retention
  • Protect recovery points with immutability
  • Separate backup administration from workload administration
  • Prove recoverability through restore testing

Architecture

Back up supported workloads into a Recovery Services vault or Backup vault, enable immutability according to the support matrix, and combine retention controls with least privilege, monitoring, and recovery testing.

Architecture flow

  • Protected workload
  • Backup policy
  • Azure Backup vault
  • Immutable recovery points
  • Restore validation
Azure WorkloadBackup PolicyBackup VaultImmutable Points
Azure Workload
Backup Policy
Backup Vault
Immutable Points

Architecture decisions

Decision

Lock only after retention is understood

Why

A locked immutable configuration is intentionally difficult or impossible to reverse, so retention and operational procedures should be validated before irreversible protection is enabled.

Trade-off

Immutability protects recovery points, but irreversible settings can also preserve unwanted data or retention mistakes longer than intended.

Decision

Immutability complements, not replaces, recovery testing

Why

Protected recovery points are valuable only if the organization can restore them within the required recovery objectives.

Trade-off

Protected backups improve resilience, but restore testing consumes capacity and operational time and may expose application-level recovery gaps.

Security

Protect the control and data paths deliberately. Use least-privilege Azure RBAC, protect privileged roles, monitor backup-security events, and keep restore procedures available through a primary-environment outage.

Availability

Design for the failure domain that must be survived. Backup vault resilience and redundancy should match the failure scenarios the protected workload must survive.

Disaster recovery

Treat regional recovery as a separate operating state. Use backup copies and vault redundancy as part of the recovery design; workload-specific replication or regional DR may still be required for tighter RPO/RTO.

Cost drivers

  • Protected instance size and type
  • Backup storage consumed
  • Retention duration
  • Redundancy selection
  • Restore and cross-region requirements

Design assumptions

  • The selected workload and region support required Azure Backup features
  • Retention requirements are approved before irreversible locking decisions

Implementation plan

  1. Classify workloads into recovery tiers with agreed backup frequency, retention, and restore objectives.
  2. Create or select the Recovery Services/Backup vault and separate backup administration from day-to-day workload operations where required.
  3. Configure policy schedules and retention before enabling immutability so the protected retention model is deliberate.
  4. Test the policy and role model, then enable the intended immutability state and document any irreversible controls.
  5. Configure failed-job and security alerts, and perform scheduled restores of representative workloads rather than validating backup jobs only.

Validate the design

  • Attempt a controlled prohibited deletion or retention change and confirm immutability behaves as intended.
  • Restore representative workloads and verify application/data usability, not only restore-job success.
  • Measure actual recovery time against the workload tier RTO.
  • Review protected retention, access roles, and alerts against current compliance and cost requirements.

Architecture basis

Continue a learning path