Backup immutability for short-term retention backup

Current State

• Short-Term Retention (PITR) backups (1–35 days) do not support immutability. These backups are stored in Microsoft-managed subscriptions and storage accounts, and while customers cannot manually delete them, reducing the PITR retention period will cause older backups to be deleted automatically. There is no option to apply WORM (Write Once, Read Many) immutability to PITR backups today.

Immutability Support

• Immutability is available only for Long-Term Retention (LTR) backups in Azure SQL Database. This feature is in public preview and allows you to configure:
• Time-based immutability: Locks backups for a defined duration (e.g., 30 days).
• Legal hold immutability: Retains backups indefinitely until the hold is explicitly removed.
• When enabled, LTR backups are stored in Azure Blob Storage with WORM policies, making them tamper-proof and compliant with regulations like SEC Rule 17a-4 and FINRA.

Why PITR Doesn’t Support Immutability

• PITR backups are designed for operational recovery and are frequently overwritten as new backups are taken. Immutability would conflict with the dynamic nature of short-term retention policies.
• Microsoft’s roadmap indicates immutability for PITR backups may be introduced later, but currently, it is not available.

Alternatives for Short-Term Protection

If you need stronger protection for PITR backups:

• RBAC and Azure Policy: Restrict permissions to prevent accidental retention changes.
• Export Automation: Regularly export database copies to your own Azure Storage with immutability enabled.

Summary:
You cannot configure immutability for short-term retention backups in Azure SQL Database today. Immutability is supported only for LTR backups (up to 10 years) via time-based or legal hold policies.