AZ-104
Deep Dive
Business continuity (BC) is the broader framework that encompasses DR. It ensures critical operations can continue during and after an incident. AZ-104 evaluates how Azure supports a BCDR strategy and the architectures that guarantee resilience.
Contents
Business Continuity is the process of ensuring critical business functions can continue during and after a disaster. It is broader than DR: DR covers IT recovery, BC also covers business processes, staff, customers and communication.
BC vs DR
Types of incidents
BCM lifecycle
The Business Impact Analysis (BIA) identifies critical business processes, quantifies the impact of their disruption, and establishes recovery priorities. It's the starting point for defining RTO and RPO.
What the BIA identifies
Critical Business Functions (CBF)
Processes that cause catastrophic impact if they fail. E.g.: payment processing, manufacturing control systems, urgent medical support.
Maximum Tolerable Downtime (MTD)
The maximum time a process can be down before irreversible damage to the business. RTO must be less than the MTD.
Work Recovery Time (WRT)
Time needed to catch up on work accumulated during the downtime (e.g.: processing pending orders). RTO + WRT ≤ MTD.
Dependencies
Which systems, vendors, people or data each critical process needs. A downed DB can halt multiple processes.
System classification
BIA output: classify each system by criticality to prioritize DR investment.
Tier 1 — Critical — RTO < 1h, RPO < 15 min
Payment system, core banking, medical control system. Maximum BC investment.
Tier 2 — Important — RTO < 8h, RPO < 1h
ERP, CRM, email. Significant but not catastrophic impact if down for a few hours.
Tier 3 — Normal — RTO < 24h, RPO < 4h
Intranet, reporting, internal tools. Operational but tolerable impact.
Tier 4 — Low — RTO days, RPO daily
File systems, historical reporting. Only basic backup needed.
| Azure service | Role in BCDR | RTO | RPO | Scope |
|---|---|---|---|---|
| Azure Backup | Backup and restore for VMs, DBs, files | Hours | Hours-days | Archive + restore |
| Azure Site Recovery | VM replication for cross-region DR | Minutes | 30 sec - 5 min | VM DR |
| SQL Failover Groups | Automatic failover for Azure SQL | < 30 sec | < 5 sec | SQL DR |
| Storage GRS/GZRS | Async replication of blobs to the paired region | Hours (Microsoft-initiated) | ~15 min lag | Storage DR |
| Traffic Manager | Automatic DNS failover between endpoints | 1-3 min | N/A (routing) | Endpoint DR |
| Azure Front Door | Global traffic failover at the edge | < 30 sec | N/A (routing) | Global app DR |
| Availability Zones | HA within a region against zone failure | < 1 sec | 0 | Intra-region HA |
| Availability Sets | Distribute VMs across fault/update domains | 0 (other VMs keep running) | 0 | VM HA |
Single region with Availability Zones
SLA 99.99%VMs across multiple zones, zone-redundant Load Balancer, zone-redundant SQL. Protects against datacenter failure. Does NOT protect against a full region failure.
Key components
Multi-region active-passive (warm standby)
RTO 15-60 min, RPO ~0Active primary region + secondary region with reduced capacity. ASR for VMs, SQL Geo-Replication. Traffic Manager for failover.
Key components
Multi-region active-active
RTO ~0, RPO ~0Both regions receive traffic simultaneously. Front Door or Traffic Manager distributes it. DB in bilateral sync. Failover is transparent.
Key components
Backup + Restore (low cost)
RTO hours, RPO hoursAzure Backup only. No active replica. For non-critical systems with limited budget.
Key components
Regulations that impose BC/DR requirements
PCI-DSS
Documented DR plan, encrypted backups, annual plan testing
HIPAA (healthcare)
Contingency plan, backup, DR and documented emergency procedures
ISO 22301
BC standard — full BCM process, BIA, plans and audits
GDPR
Ability to restore personal data within an appropriate time after an incident
SOC 2
Availability controls, including DR and regular testing
Contractual SLA vs Azure SLA
Microsoft's SLA for Azure services is a financial commitment — if not met, they offer service credits. They don't guarantee your application has 99.99% uptime — that depends on how you've designed it.
Azure SLA = resource availability
Azure VM in an AZ: 99.99% → if the VM is unavailable for more than 52 min/year, Microsoft issues a credit.
Your application's SLA = composite SLA
Your app uses VM (99.99%) + SQL (99.99%) + LB (99.99%). Composite SLA = 99.99% × 99.99% × 99.99% ≈ 99.97%.
| Service / Concept | What it's for | Key difference |
|---|---|---|
| Azure Backup | Backups and restoration | Multiple historical recovery points. RPO = backup frequency. |
| Azure Site Recovery | DR — continuous VM replication | Not backup — no multiple historical points. RPO = 30 sec. |
| Recovery Services Vault | Container for Backup and ASR | Supports Backup + ASR. The most complete and most common on the exam. |
| Backup Vault | Container for modern PaaS backup | Backup only (no ASR). For Blobs, Disks, PostgreSQL, AKS. |
| RTO | Maximum tolerable downtime | Measures SYSTEM downtime. RTO < MTD. |
| RPO | Maximum tolerable data loss (in time) | Measures DATA loss. RPO determines backup/replication frequency. |
| Failover | Activating the secondary system when the primary fails | Can be automatic (TM, SQL Failover Groups) or manual (ASR). |
| Failback | Returning to the primary system once it recovers | In ASR: requires Re-protect first. Never do a rushed failback. |
| Test Failover (ASR) | Test DR without impacting production | Test VMs in an isolated VNet. Production is not interrupted. |
| Soft Delete | Retain backup data after deletion | 14 additional days of retention. Protects against accidental/malicious deletion. |
| Availability Zones | Intra-region HA (a DC zone fails) | Does NOT protect against a full region failure. |
| Region Pairs | Cross-region DR, geographically separated | For regional disasters. GRS, ASR and CRR use the paired region. |
Did you get this topic?
Test what you just learned
A financial services company needs to ensure its payments application can recover from a regional disaster with RTO < 30 minutes and RPO < 5 minutes, complying with PCI-DSS. Which combination of services is most appropriate?
Put what you learned to the test with original AZ-104 exam questions.
Start AZ-104 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.