AZ-104
Deep Dive
Azure Backup is Azure's centralized backup service. The AZ-104 tests policy configuration, vault types, restore options, and data protection.
Contents
Azure has two types of vault for storing backups. Choosing the right one is critical and is tested on the exam.
| Dimension | Recovery Services Vault | Backup Vault (new) |
|---|---|---|
| Workloads | Azure VMs, SQL on VM, SAP HANA on VM, Azure Files, MABS, DPM, Windows Server (MARS) | Azure Disks, Azure Blobs, Azure Database for PostgreSQL, AKS |
| Site Recovery | Yes — Azure Site Recovery uses the RSV | No |
| Model | Legacy but full-featured. Will be gradually replaced. | New model. Simpler, native REST APIs. |
| Vault redundancy | LRS, GRS, ZRS | LRS, GRS, ZRS |
| Cross-Region Restore | Yes (with GRS enabled) | Yes (for compatible workloads) |
| Granular RBAC | Backup roles (Backup Contributor, Operator, Reader) | Similar Backup roles |
For the exam
On the current AZ-104, most backup questions refer to the Recovery Services Vault (VMs, SQL on VM, Azure Files). If the question mentions "Blobs" or "Disks" as the native backup object, the vault may be the Backup Vault. The RSV remains the primary vault for Site Recovery.
Azure VMs
Disk-level backup (snapshot). Supports Premium and Ultra disks. Crash-consistent + app-consistent (VSS on Windows, pre/post scripts on Linux).
SQL Server on VM
Point-in-time recovery at the database level. Auto-protection: new DBs on the instance are protected automatically.
Azure Files (File Shares)
Full-share backup. Granular restore: individual files or folders. Snapshots are instant (incremental).
On-premises (Windows Server / MABS)
Direct backup of files, folders, and system state. No intermediate VM. The MARS agent is downloaded from the vault.
Policy components
Backup frequency
When the backup runs: daily, weekly, hourly (Enhanced). For SQL: Full + Differential + Log.
Retention (retention range)
How long recovery points are kept. GFS (Grandfather-Father-Son): differentiated policies for daily/weekly/monthly/yearly.
Vault redundancy
LRS (local), GRS (geo-redundant), ZRS (zone-redundant). Affects the storage cost of the backup.
Backup time
Time window in which Azure runs the backup. For VMs with the Enhanced policy: multiple points per day.
GFS Policies (Grandfather-Father-Son)
GFS allows differentiated retention based on the age of the recovery point. It lets you keep only one monthly/yearly backup for years without keeping every daily backup.
Azure Policy for backup at scale
You can use Azure Policy to ensure that all new VMs in a subscription/RG are automatically associated with a Recovery Services Vault under a backup policy. Built-in policy: Configure backup on VMs with a given tag to an existing recovery services vault.
| Option | What it restores | Destination | When to use |
|---|---|---|---|
| Replace existing (VM) | Full VM | Replaces the original VM in the same RG | Recover the same VM — overwrites disks and configuration |
| Create new (VM) | Full VM | New VM in a region/RG of your choice | You don't want to overwrite the original, or you're restoring to another region/RG |
| Restore disks | VHD disks in a Storage Account | Storage Account of your choice | You want to attach the disks to an existing VM or use them in a custom flow |
| File Recovery (ILR) | Individual files or folders | Mounts the snapshot as a volume on another VM | Recover just one file without restoring the whole VM |
| Cross-Region Restore | VM or data from the secondary region | The GRS vault's secondary region | Primary region unavailable — full region DR |
| Point-in-time (SQL) | SQL DB to a point in time | Same instance or new SQL instance | Recover from data corruption, accidental deletion |
Instant Restore (Operational Tier)
For Azure VMs, Azure Backup keeps snapshots locally (in the same RG as the VM) for 1-5 days before transferring them to the vault. Restoring from these local snapshots is much faster than restoring from the vault — seconds/minutes vs. hours. Configurable in the backup policy.
Soft Delete
When Soft Delete is enabled (on by default since 2020), deleting a backup or stopping protection on a resource retains the backup data for an additional 14 days before it is permanently purged.
→ Status of the deleted item: Soft Deleted
→ To recover: "Undelete" in the vault → restores the state to "Stop protection with retain data"
→ To purge immediately: "Undelete" first, then permanently "Delete backup data"
→ Backup storage is billed during those 14 days
Protects against accidental deletion and ransomware attacks.
Enhanced Soft Delete (Always-on)
A more secure option: Soft Delete is always on and irrevocable (cannot be disabled). Protects against malicious administrators who might disable Soft Delete before deleting backups.
Immutable Vault
Recovery points cannot be deleted before their expiration date defined in the policy. Maximum protection against ransomware and malicious actors with admin access.
• Locked: immutability cannot be disabled (max. security)
• Unlocked: can be disabled if needed
• Compatible with Azure Policy for enforcement at scale
MARS Agent (Microsoft Azure Recovery Services Agent)
A lightweight agent installed on Windows Server or a Windows VM. Backs up directly to Azure. Files, folders, and system state only.
Windows servers that don't need application-level backup. Simple, no intermediate infrastructure.
MABS (Microsoft Azure Backup Server)
Free on-premises backup server (no additional license). Backs up to local disk AND to Azure. Supports workloads: Hyper-V/VMware VMs, SQL, SharePoint, Exchange.
On-prem environments that need application-aware backup with local disk + cloud as secondary.
Comparison: MARS vs MABS vs Azure Backup Extension (VM)
| Feature | MARS Agent | MABS | VM Extension |
|---|---|---|---|
| Location | On-prem / Azure VM | Dedicated on-prem server | Azure VM |
| Hyper-V/VMware VM backup | ✗ | ✓ | Not applicable |
| SQL app-aware | ✗ | ✓ | ✓ (with SQL extension) |
| Backup to local disk | ✗ | ✓ (DPM storage pool) | Local snapshot (Instant Restore) |
| License cost | Free | Free (MABS) / Licensed (DPM) | Free (included) |
Backup Center
A centralized dashboard for managing and monitoring all of the organization's backups (multiple vaults, subscriptions). Unified view of jobs, alerts, and policy compliance.
Azure Monitor + Alerts
Configure alerts for critical events: failed backup, deleted vault, Soft Delete disabled. Backup logs are sent to Log Analytics for KQL queries.
Reports (Backup Reports)
Embedded Power BI reports: storage usage trends, historical jobs, resource coverage. Requires configuring diagnostics to the Log Analytics Workspace.
Did you get this topic?
Test what you just learned
An administrator accidentally deletes all recovery points of a VM in the Recovery Services Vault. Soft Delete was enabled. How long do they have to recover the data before it is permanently purged?
Put what you learned to the test with original AZ-104 exam questions.
Start AZ-104 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.