Skip to content

Backup and Restore of Managed VMs

The core MCP spoke does not back up your VMs (Operate your workload). The Managed VM module does: it deploys a backup vault and a policy for each VM configuration. This page describes the defaults and how to make and restore a backup.

Backup solutions

Solution What it is Typical use
Recovery Services vault (RSV) Full VM backups, restore of a whole VM or of a disk The default choice. Easier to use than the Backup Vault.
Backup Vault Fast, operational snapshots of the managed disks Restore of a single disk

You choose the solution(s) per VM configuration (Request and change). Older versions of the module defaulted to the Backup Vault. The default is now the Recovery Services vault. Check which one your VMs use.

Default policy

The default of the Recovery Services vault policy:

Setting Value
Frequency Every day, every 8 hours
Instant snapshot retention 7 days
Daily recovery points 28 days
Weekly recovery points none
Monthly recovery points one, kept for 6 months
Yearly recovery points none

The RPO (in hours) and the retention (in days) are options of the VM configuration. The retention must be more than 7 days. The RPO of a Backup Vault can't be changed after it is set. Choose values from your classification and the recovery time you need.

Defaults are platform choices

These values are the defaults of the module in its current form. Your platform can have another default. The staging storage account of the vault denies public access by default.

Alerts

The module can alert on failures in the Recovery Services vault: either on all job failures or on critical operation failures only. Ask your platform team which is on and who gets the alerts. Treat a failed backup job as an incident for your VM: the next restore depends on it.

Make an extra backup

Before a risky change (a major upgrade, a manual change in the OS), take an extra backup.

  1. Activate the Contributor role on the spoke in PIM (Access, groups and PIM).
  2. In the portal, open the Recovery Services vault in the resource group of the managed VM.
  3. Go to Protected items → Backup items and select Azure Virtual Machine.
  4. Select View details for the VM and choose Backup now in the toolbar.
  5. Enter how long the backup must be retained.

Restore a whole VM (Recovery Services vault)

With Replace existing you replace the VM with an earlier state. That rolls the VM back, including everything that changed after the restore point.

  1. Activate the Contributor role in PIM.
  2. Stop the virtual machine.
  3. Open the Recovery Services vault in the resource group of the managed VM.
  4. Go to Protected items → Backup items and select Azure Virtual Machine.
  5. Select View details for the VM and choose Restore Virtual Machine.
  6. Select a restore point.
  7. For Restore target choose Replace existing.
  8. Select the staging storage account. It is in the resource group of the Managed VM deployment and is tagged usage = "Recovery Services Vault Staging".
  9. Decide in Skip pre-restore backup whether a backup is made before the restore.
  10. Start the restore. When it has finished, start the VM.

Restore a disk and recover files

Use this when you only need files from an earlier state, or one disk.

With the Recovery Services vault: choose Restore disk instead of Replace existing in step 7. This creates a new disk from the restore point, which you attach to the VM.

With the Backup Vault:

  1. Open the Backup Vault in the resource group of the managed VM and go to Backup instances.
  2. Select Restore, then the backup instance (the disk) and the restore point.
  3. Choose the location and a name for the restored disk, and select Validate. Validation can take a few minutes.
  4. When validation is OK, proceed and finish the restore.
  5. Follow the restore on the Backup jobs page.
  6. Open the VM, go to Disks and select Attach existing disks. Select the restored disk.
  7. Set Host caching to read/write. Optionally detach the old disk.

The module already sets the role assignments the Backup Vault needs. Skip that part of the Microsoft Learn guide.

The restored disk is a new disk in the resource group of the VM. Then mount it in the OS (Linux) or bring it online (Windows). That step is not supported by the module or the platform team: mount a disk on Linux. See also Operating system.

Test your restore

A backup you have not restored is not a backup. Restore a disk or a test VM regularly, and write down who restores in which order for your workload. See Operate your workload.