Built-in protection for your most recent backups - enabled automatically
Today, we're excited to announce General Availability of automatic backup immutability up to the most recent 7 days of point-in-time restore (PITR) backups in Azure SQL Database and Azure SQL Managed Instance, at no additional cost.
With this release, up to most recent 7 days of backups are automatically protected with immutability by default, regardless of your configured PITR retention period. No configuration changes, policy creation, or administrative action are required.
This enhancement provides an additional layer of protection for one of your most critical recovery assets - your backups.
Why backup immutability matters
Cyberattacks continue to evolve, with ransomware increasingly targeting not only production data, but also backup systems. Attackers understand that if backups can be deleted, modified, or corrupted, recovery becomes significantly more difficult and costly.
Traditional backup strategies focus on creating recoverable copies of data. Modern cyber-resilience strategies go further by ensuring those backups themselves cannot be altered or removed during a protected period.
Immutable backups help ensure that recovery points remain available when you need them most - even in the face of malicious actions, accidental deletion, or compromised administrative credentials.
What is changing?
Starting with this release:
- Up to the most recent 7 days of Azure SQL Database and Azure SQL Managed Instance PITR backups are automatically protected by immutability
- Protection is enabled by default for all databases, with no additional cost
- No configuration or onboarding is required
- Protection applies regardless of the database's configured PITR retention setting
Because this capability is built directly into the Azure SQL backup service, customers automatically benefit from stronger protection without changing existing backup, restore, or operational workflows.
Designed for modern cyber resilience
Organizations across industries increasingly require stronger safeguards around backup data as part of broader cyber-resilience programs.
Automatic backup immutability helps customers:
- Improve protection against ransomware attacks
- Reduce the risk of accidental backup deletion
- Strengthen recovery readiness
- Increase confidence that recent recovery points remain available during an incident
- Simplify adoption of immutable backup practices without additional deployment effort
This capability is particularly valuable because the backups most often used during recovery operations are typically the most recent ones.
Supporting compliance and governance requirements
Many industries must maintain records in a protected, tamper-resistant manner to satisfy regulatory and governance requirements.
Azure Storage immutable storage capabilities have been validated for compliance scenarios involving requirements such as:
- SEC Rule 17a-4(f)
- CFTC Rule 1.31(d)
- FINRA record-retention requirements
These regulations commonly require records to be retained in a nonerasable, non-rewritable format for a defined period of time. Azure immutable storage uses a Write Once, Read Many (WORM) model that helps organizations meet these requirements.
Azure SQL database backups leverage this WORM capability from Azure storage to achieve immutability for the backups. While compliance requirements vary by organization and jurisdiction, automatic backup immutability provides an additional foundational control that can support broader security, governance, and resilience objectives.
No additional complexity
One of our goals with this release is to deliver stronger security without increasing operational burden.
You don't need to:
- Create immutability policies
- Configure storage accounts
- Manage retention locks
- Extract data
The protection is integrated directly into the Azure SQL managed backup service and works automatically for all Azure SQL Database and Azure SQL Managed Instance databases.
Pricing and Availability
Automatic backup immutability up to the most recent 7 days of point-in-time restore (PITR) backups is available for all Azure SQL Database and Azure SQL Managed Instance databases.
There is no additional cost to use this capability. The protection is built into the Azure SQL managed backup service and is automatically applied to the most recent 7 days of backups. No configuration, policy management, or separate licensing is required.
By enabling immutable protection by default and at no additional charge, Azure SQL helps customers strengthen their cyber-resilience posture, improve protection against ransomware and accidental deletion, and gain the benefits of immutable backups without added operational complexity.
Building on Azure SQL's data protection foundation
Automatic backup immutability is the latest enhancement in Azure SQL's ongoing investment in data protection, security, and business continuity.
By combining automated backups, point-in-time restore capabilities, geo-redundant backup options, soft delete protection for your Azure SQL logical server and now automatic backup immutability for recent backups, Azure SQL continues to help organizations strengthen their resilience against both operational accidents and modern cyber threats.
This is just the beginning. Azure SQL hyperscale backup immutability and a host of other additional capabilities are coming soon.
FAQs
Q: What is changing?
A: Microsoft Azure SQL will start protecting the short-term retention backups for all Azure SQL DB and Azure SQL managed instance databases with immutability to protect against ransomware attacks.
Q: Are all my backups protected?
A: In this release, up to most recent 7 days of short-term retention backups are immutable, regardless of the configured retention period. For example, if the configured retention period is 7 or less, then all the backups are immutable. If the configured retention period is 35 days, then the most recent 7 days of backups are immutable.
Q: Is there any additional cost for this feature?
A: No. Immutability for the backups is being provided as a security feature natively.
Q: When will this be available?
A: The code to enable immutable policy is already in progress in all Azure regions worldwide. In the next few weeks all backups will be on immutable storage.
Q: Do I need to do anything to enable/configure immutability?
A: No. There is no action needed on your end. The backups will automatically be immutable once the enablement is complete.
Q: How can I verify if my backups are immutable?
A: In a future release, immutability status will be exposed as a database property.
Q: How can I get immutability for my backups beyond 7 days?
A: In this release backups up to most recent 7 days are immutable. Immutability for additional retention period will be added in a future release.
Limitations
Immutability for Azure SQL hyperscale is not included in this release but will be available soon.
Learn more
To learn more about immutable storage concepts and WORM (Write Once, Read Many) protection in Azure, see:
We are excited to bring this protection to every Azure SQL Database and Azure SQL Managed Instance customer automatically, helping you improve backup security and recovery readiness with no additional effort.
Documentation updates
More details at https://aka.ms/auto-immutability
Looking ahead
We are just getting started on this journey of ransomware protection. Additional flexibility and configuration options coming in future releases.
Microsoft
