Forum Discussion
Patterns for low-code Azure config state snapshot + recovery solution for resource groups
I’m looking for patterns that capture resource configuration changes over time and support best-effort recovery (redeployment) of resource config state.
I understand that authoritative IaC (Bicep) would be the most mature option, however, I am wondering if anyone has ever implemented a solution similar to what I have described above.
Ideally this would be a low-code, Azure native solution.
2 Replies
The closest Azure-native low-code pattern is good for change history and best-effort redeploy, but I would not call it a true restore system.
A workable pattern is:
1. Use Azure Resource Graph Change Analysis to query resource property changes.
2. Export those change records on a schedule with Logic Apps or Automation into Log Analytics, Storage, or a Git repo for retention beyond the built-in window.
3. Use Azure Policy to detect and optionally remediate known drift.
4. Use Bicep/ARM/Terraform for the resources where you really need repeatable recovery.
The main limitation is that Resource Graph can tell you what changed, but it is not a full backup of every resource's desired state, secrets, data-plane config, or provider-specific side effects. So I would use it as a drift/audit layer, then generate redeployment tasks from known-good templates rather than trying to "restore" arbitrary resource groups directly.
Useful docs:
https://learn.microsoft.com/azure/governance/resource-graph/changes/get-resource-changes
https://learn.microsoft.com/azure/governance/resource-graph/changes/resource-graph-changes
I think, you can try log analytics workspace. Because, there are defferences between monitoring and capturing . So, we can't restore resources configurations on a time span, like what happening by restoring VMs.
