Configure backup on Azure File Storage with a given tag to an existing recovery services vault

%3CLINGO-SUB%20id%3D%22lingo-sub-2869541%22%20slang%3D%22en-US%22%3EConfigure%20backup%20on%20Azure%20File%20Storage%20with%20a%20given%20tag%20to%20an%20existing%20recovery%20services%20vault%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2869541%22%20slang%3D%22en-US%22%3E%3CP%3EHow%20to%20create%20a%20Custom%20Azure%20Policy%20that%26nbsp%3BConfigure%20backup%20on%20Azure%20File%20Share%20Storage%20with%20a%20given%20tag%20to%20an%20existing%20recovery%20services%20vault.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2869541%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Policy%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2884763%22%20slang%3D%22en-US%22%3ERe%3A%20Configure%20backup%20on%20Azure%20File%20Storage%20with%20a%20given%20tag%20to%20an%20existing%20recovery%20services%20vault%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2884763%22%20slang%3D%22en-US%22%3EAzure%20Backup%20does%20not%20support%20natively%20this%20feature.%20However%2C%20you%20can%20define%20a%20custom%20Azure%20Policy%20to%20deploy%20Azure%20Backup%20when%20a%20VM%20is%20created%20or%20updated%20with%20a%20specific%20tag.%20Have%20a%20look%20at%20the%20%22Configure%20backup%20on%20VMs%20of%20a%20location%20to%20an%20existing%20central%20Vault%20in%20the%20same%20location%22%20and%20%22Configure%20backup%20on%20VMs%20with%20a%20given%20tag%20to%20an%20existing%20recovery%20services%20vault%20in%20the%20same%20location%20%22%20built-in%20policy.%20It%20should%20be%20a%20good%20reference%20for%20developing%20your%20own%20policy.%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fbackup%2Fbackup-azure-auto-enable-backup%23%3A~%3Atext%3DFilter%2520the%2520list%2520for%2520Category%253DBackup%2520and%2520select%2520the%2CAssign%2520button%2520at%2520the%2520top%2520of%2520the%2520pane%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fbackup%2Fbackup-azure-auto-enable-backup%23%3A~%3Atext%3DFilter%2520the%2520list%2520for%2520Category%253DBackup%2520and%2520select%2520the%2CAssign%2520button%2520at%2520the%2520top%2520of%2520the%2520pane%3C%2FA%3E.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2885023%22%20slang%3D%22en-US%22%3ERe%3A%20Configure%20backup%20on%20Azure%20File%20Storage%20with%20a%20given%20tag%20to%20an%20existing%20recovery%20services%20vault%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2885023%22%20slang%3D%22en-US%22%3EI%20have%20try%20to%20refer%20this%20policy%20%26amp%3B%20created%20below%20custom%20policy.%20Somehow%20this%20is%20not%20working%20as%20expected.%20Could%20you%20please%20help%20to%20debug%20this%3F%3CBR%20%2F%3E%3CBR%20%2F%3E%7B%3CBR%20%2F%3E%22properties%22%3A%20%7B%3CBR%20%2F%3E%22displayName%22%3A%20%22Configure%20backup%20on%20Storageaccount%20with%20a%20given%20tag%20to%20an%20existing%20recovery%20services%20vault%20in%20the%20same%20location%22%2C%3CBR%20%2F%3E%22policyType%22%3A%20%22BuiltIn%22%2C%3CBR%20%2F%3E%22mode%22%3A%20%22Indexed%22%2C%3CBR%20%2F%3E%22description%22%3A%20%22Enforce%20backup%20for%20all%20stoageaccount%20by%20backing%20them%20up%20to%20an%20existing%20central%20recovery%20services%20vault%20in%20the%20same%20location%20and%20subscription%20as%20the%20virtual%20machine.%20Doing%20this%20is%20useful%20when%20there%20is%20a%20central%20team%20in%20your%20organization%20managing%20backups%20for%20all%20resources%20in%20a%20subscription.%20You%20can%20optionally%20include%20virtual%20machines%20containing%20a%20specified%20tag%20to%20control%20the%20scope%20of%20assignment.%20See%20%3CA%20href%3D%22https%3A%2F%2Faka.ms%2FAzureVMCentralBackupIncludeTag%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Faka.ms%2FAzureVMCentralBackupIncludeTag%3C%2FA%3E.%22%2C%3CBR%20%2F%3E%22metadata%22%3A%20%7B%3CBR%20%2F%3E%22version%22%3A%20%223.0.0%22%2C%3CBR%20%2F%3E%22category%22%3A%20%22Backup%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22parameters%22%3A%20%7B%3CBR%20%2F%3E%22vaultLocation%22%3A%20%7B%3CBR%20%2F%3E%22type%22%3A%20%22String%22%2C%3CBR%20%2F%3E%22metadata%22%3A%20%7B%3CBR%20%2F%3E%22displayName%22%3A%20%22Location%20(Specify%20the%20location%20of%20the%20VMs%20that%20you%20want%20to%20protect)%22%2C%3CBR%20%2F%3E%22description%22%3A%20%22Specify%20the%20location%20of%20the%20VMs%20that%20you%20want%20to%20protect.%20VMs%20should%20be%20backed%20up%20to%20a%20vault%20in%20the%20same%20location.%20For%20example%20-%20CanadaCentral%22%2C%3CBR%20%2F%3E%22strongType%22%3A%20%22location%22%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22inclusionTagName%22%3A%20%7B%3CBR%20%2F%3E%22type%22%3A%20%22String%22%2C%3CBR%20%2F%3E%22metadata%22%3A%20%7B%3CBR%20%2F%3E%22displayName%22%3A%20%22Inclusion%20Tag%20Name%22%2C%3CBR%20%2F%3E%22description%22%3A%20%22Name%20of%20the%20tag%20to%20use%20for%20including%20VMs%20in%20the%20scope%20of%20this%20policy.%20This%20should%20be%20used%20along%20with%20the%20Inclusion%20Tag%20Value%20parameter.%20Learn%20more%20at%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22defaultValue%22%3A%20%22%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22inclusionTagValue%22%3A%20%7B%3CBR%20%2F%3E%22type%22%3A%20%22Array%22%2C%3CBR%20%2F%3E%22metadata%22%3A%20%7B%3CBR%20%2F%3E%22displayName%22%3A%20%22Inclusion%20Tag%20Values%22%2C%3CBR%20%2F%3E%22description%22%3A%20%22Value%20of%20the%20tag%20to%20use%20for%20including%20VMs%20in%20the%20scope%20of%20this%20policy%20(in%20case%20of%20multiple%20values%2C%20use%20a%20comma-separated%20list).%20This%20should%20be%20used%20along%20with%20the%20Inclusion%20Tag%20Name%20parameter.%20Learn%20more%20at%20%3CA%20href%3D%22https%3A%2F%2Faka.ms%2FAppCentricVMBackupPolicy%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Faka.ms%2FAppCentricVMBackupPolicy%3C%2FA%3E.%22%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22backupPolicyId%22%3A%20%7B%3CBR%20%2F%3E%22type%22%3A%20%22String%22%2C%3CBR%20%2F%3E%22metadata%22%3A%20%7B%3CBR%20%2F%3E%22displayName%22%3A%20%22Backup%20Policy%20(of%20type%20Storage%20Account%20from%20a%20vault%20in%20the%20location%20chosen%20above)%22%2C%3CBR%20%2F%3E%22description%22%3A%20%22Specify%20the%20ID%20of%20the%20Azure%20Backup%20policy%20to%20configure%20backup%20of%20the%20Storage%20Account.%20The%20selected%20Azure%20Backup%20policy%20should%20be%20of%20type%20Azure%20Storage%20Account.%20This%20policy%20needs%20to%20be%20in%20a%20vault%20that%20is%20present%20in%20the%20location%20chosen%20above.%20For%20example%20-%20%2Fsubscriptions%2F%3CSUBSCRIPTIONID%3E%2FresourceGroups%2F%3CRESOURCEGROUPNAME%3E%2Fproviders%2FMicrosoft.RecoveryServices%2Fvaults%2F%3CVAULTNAME%3E%2FbackupPolicies%2F%3CBACKUPPOLICYNAME%3E%22%2C%3CBR%20%2F%3E%22strongType%22%3A%20%22Microsoft.RecoveryServices%2Fvaults%2FbackupPolicies%22%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22effect%22%3A%20%7B%3CBR%20%2F%3E%22type%22%3A%20%22String%22%2C%3CBR%20%2F%3E%22metadata%22%3A%20%7B%3CBR%20%2F%3E%22displayName%22%3A%20%22Effect%22%2C%3CBR%20%2F%3E%22description%22%3A%20%22Enable%20or%20disable%20the%20execution%20of%20the%20policy%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22allowedValues%22%3A%20%5B%3CBR%20%2F%3E%22deployIfNotExists%22%2C%3CBR%20%2F%3E%22auditIfNotExists%22%2C%3CBR%20%2F%3E%22disabled%22%3CBR%20%2F%3E%5D%2C%3CBR%20%2F%3E%22defaultValue%22%3A%20%22deployIfNotExists%22%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22policyRule%22%3A%20%7B%3CBR%20%2F%3E%22if%22%3A%20%7B%3CBR%20%2F%3E%22allOf%22%3A%20%5B%3CBR%20%2F%3E%7B%3CBR%20%2F%3E%22field%22%3A%20%22type%22%2C%3CBR%20%2F%3E%22equals%22%3A%20%22Microsoft.Storage%2FstorageAccounts%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%7B%3CBR%20%2F%3E%22field%22%3A%20%22id%22%2C%3CBR%20%2F%3E%22notContains%22%3A%20%22%2FresourceGroups%2Fdatabricks-rg-%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%7B%3CBR%20%2F%3E%22field%22%3A%20%22location%22%2C%3CBR%20%2F%3E%22equals%22%3A%20%22%5Bparameters('vaultLocation')%5D%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%7B%3CBR%20%2F%3E%22field%22%3A%20%22%5Bconcat('tags%5B'%2C%20parameters('inclusionTagName')%2C%20'%5D')%5D%22%2C%3CBR%20%2F%3E%22in%22%3A%20%22%5Bparameters('inclusionTagValue')%5D%22%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%3CBR%20%2F%3E%5D%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22then%22%3A%20%7B%3CBR%20%2F%3E%22effect%22%3A%20%22%5Bparameters('effect')%5D%22%2C%3CBR%20%2F%3E%22details%22%3A%20%7B%3CBR%20%2F%3E%22roleDefinitionIds%22%3A%20%5B%3CBR%20%2F%3E%22%2Fproviders%2Fmicrosoft.authorization%2FroleDefinitions%2FXXXXXXXXXXXX%22%2C%3CBR%20%2F%3E%22%2Fproviders%2Fmicrosoft.authorization%2FroleDefinitions%2FXXXXXXXXXXXX%22%3CBR%20%2F%3E%5D%2C%3CBR%20%2F%3E%22type%22%3A%20%22Microsoft.RecoveryServices%2Fbackupprotecteditems%22%2C%3CBR%20%2F%3E%22deployment%22%3A%20%7B%3CBR%20%2F%3E%22properties%22%3A%20%7B%3CBR%20%2F%3E%22mode%22%3A%20%22incremental%22%2C%3CBR%20%2F%3E%22template%22%3A%20%7B%3CBR%20%2F%3E%22%24schema%22%3A%20%22%3CA%20href%3D%22http%3A%2F%2Fschema.management.azure.com%2Fschemas%2F2015-01-01%2FdeploymentTemplate.json%23%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Fschema.management.azure.com%2Fschemas%2F2015-01-01%2FdeploymentTemplate.json%23%3C%2FA%3E%22%2C%3CBR%20%2F%3E%22contentVersion%22%3A%20%221.0.0.0%22%2C%3CBR%20%2F%3E%22parameters%22%3A%20%7B%3CBR%20%2F%3E%22backupPolicyId%22%3A%20%7B%3CBR%20%2F%3E%22type%22%3A%20%22String%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22fabricName%22%3A%20%7B%3CBR%20%2F%3E%22type%22%3A%20%22String%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22protectionContainers%22%3A%20%7B%3CBR%20%2F%3E%22type%22%3A%20%22String%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22protectedItems%22%3A%20%7B%3CBR%20%2F%3E%22type%22%3A%20%22String%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22sourceResourceId%22%3A%20%7B%3CBR%20%2F%3E%22type%22%3A%20%22String%22%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22resources%22%3A%20%5B%3CBR%20%2F%3E%7B%3CBR%20%2F%3E%22apiVersion%22%3A%20%222017-05-10%22%2C%3CBR%20%2F%3E%22name%22%3A%20%22%5Bconcat('DeployProtection-'%2CuniqueString(parameters('protectedItems')))%5D%22%2C%3CBR%20%2F%3E%22type%22%3A%20%22Microsoft.Resources%2Fdeployments%22%2C%3CBR%20%2F%3E%22resourceGroup%22%3A%20%22%5Bfirst(skip(split(parameters('backupPolicyId')%2C%20'%2F')%2C%204))%5D%22%2C%3CBR%20%2F%3E%22subscriptionId%22%3A%20%22%5Bfirst(skip(split(parameters('backupPolicyId')%2C%20'%2F')%2C%202))%5D%22%2C%3CBR%20%2F%3E%22properties%22%3A%20%7B%3CBR%20%2F%3E%22mode%22%3A%20%22Incremental%22%2C%3CBR%20%2F%3E%22template%22%3A%20%7B%3CBR%20%2F%3E%22%24schema%22%3A%20%22%3CA%20href%3D%22https%3A%2F%2Fschema.management.azure.com%2Fschemas%2F2015-01-01%2FdeploymentTemplate.json%23%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fschema.management.azure.com%2Fschemas%2F2015-01-01%2FdeploymentTemplate.json%23%3C%2FA%3E%22%2C%3CBR%20%2F%3E%22contentVersion%22%3A%20%221.0.0.0%22%2C%3CBR%20%2F%3E%22parameters%22%3A%20%7B%3CBR%20%2F%3E%22backupPolicyId%22%3A%20%7B%3CBR%20%2F%3E%22type%22%3A%20%22String%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22fabricName%22%3A%20%7B%3CBR%20%2F%3E%22type%22%3A%20%22String%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22protectionContainers%22%3A%20%7B%3CBR%20%2F%3E%22type%22%3A%20%22String%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22protectedItems%22%3A%20%7B%3CBR%20%2F%3E%22type%22%3A%20%22String%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22sourceResourceId%22%3A%20%7B%3CBR%20%2F%3E%22type%22%3A%20%22String%22%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22resources%22%3A%20%5B%3CBR%20%2F%3E%7B%3CBR%20%2F%3E%22type%22%3A%20%22Microsoft.RecoveryServices%2Fvaults%2FbackupFabrics%2FprotectionContainers%2FprotectedItems%22%2C%3CBR%20%2F%3E%22name%22%3A%20%22%5Bconcat(first(skip(split(parameters('backupPolicyId')%2C%20'%2F')%2C%208))%2C%20'%2F'%2C%20parameters('fabricName')%2C%20'%2F'%2Cparameters('protectionContainers')%2C%20'%2F'%2C%20parameters('protectedItems'))%5D%22%2C%3CBR%20%2F%3E%22apiVersion%22%3A%20%222016-06-01%22%2C%3CBR%20%2F%3E%22properties%22%3A%20%7B%3CBR%20%2F%3E%22protectedItemType%22%3A%20%22Microsoft.Storage%2FstorageAccounts%22%2C%3CBR%20%2F%3E%22policyId%22%3A%20%22%5Bparameters('backupPolicyId')%5D%22%2C%3CBR%20%2F%3E%22sourceResourceId%22%3A%20%22%5Bparameters('sourceResourceId')%5D%22%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%5D%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22parameters%22%3A%20%7B%3CBR%20%2F%3E%22backupPolicyId%22%3A%20%7B%3CBR%20%2F%3E%22value%22%3A%20%22%5Bparameters('backupPolicyId')%5D%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22fabricName%22%3A%20%7B%3CBR%20%2F%3E%22value%22%3A%20%22%5Bparameters('fabricName')%5D%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22protectionContainers%22%3A%20%7B%3CBR%20%2F%3E%22value%22%3A%20%22%5Bparameters('protectionContainers')%5D%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22protectedItems%22%3A%20%7B%3CBR%20%2F%3E%22value%22%3A%20%22%5Bparameters('protectedItems')%5D%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22sourceResourceId%22%3A%20%7B%3CBR%20%2F%3E%22value%22%3A%20%22%5Bparameters('sourceResourceId')%5D%22%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%5D%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22parameters%22%3A%20%7B%3CBR%20%2F%3E%22backupPolicyId%22%3A%20%7B%3CBR%20%2F%3E%22value%22%3A%20%22%5Bparameters('backupPolicyId')%5D%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22fabricName%22%3A%20%7B%3CBR%20%2F%3E%22value%22%3A%20%22AzureStorage%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22protectionContainers%22%3A%20%7B%3CBR%20%2F%3E%22value%22%3A%20%22%5Bconcat('%2Fazfileshare%3B'%2C%20resourceGroup().name%2C%20'%3B'%20%2Cfield('name'))%5D%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22protectedItems%22%3A%20%7B%3CBR%20%2F%3E%22value%22%3A%20%22%5Bconcat('%2Fazfileshare%3B'%2C%20resourceGroup().name%2C%20'%3B'%20%2Cfield('name'))%5D%22%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22sourceResourceId%22%3A%20%7B%3CBR%20%2F%3E%22value%22%3A%20%22%5Bconcat('%2Fsubscriptions%2F'%2C%20subscription().subscriptionId%2C%20'%2FresourceGroups%2F'%2C%20resourceGroup().name%2C%20'%2Fproviders%2FMicrosoft.Compute%2FvirtualMachines%2F'%2Cfield('name'))%5D%22%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%7D%2C%3CBR%20%2F%3E%22id%22%3A%20%22%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2FXXXXXXXXXXXXXXX%22%2C%3CBR%20%2F%3E%22type%22%3A%20%22Microsoft.Authorization%2FpolicyDefinitions%22%2C%3CBR%20%2F%3E%22name%22%3A%20%22XXXXXXXXXXXXXXX%22%3CBR%20%2F%3E%7D%3C%2FBACKUPPOLICYNAME%3E%3C%2FVAULTNAME%3E%3C%2FRESOURCEGROUPNAME%3E%3C%2FSUBSCRIPTIONID%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

How to create a Custom Azure Policy that Configure backup on Azure File Share Storage with a given tag to an existing recovery services vault.

4 Replies
Azure Backup does not support natively this feature. However, you can define a custom Azure Policy to deploy Azure Backup when a VM is created or updated with a specific tag. Have a look at the "Configure backup on VMs of a location to an existing central Vault in the same location" and "Configure backup on VMs with a given tag to an existing recovery services vault in the same location " built-in policy. It should be a good reference for developing your own policy.
https://docs.microsoft.com/en-us/azure/backup/backup-azure-auto-enable-backup#:~:text=Filter%20the%2....
I have try to refer this policy & created below custom policy. Somehow this is not working as expected. Could you please help to debug this?

{
"properties": {
"displayName": "Configure backup on Storageaccount with a given tag to an existing recovery services vault in the same location",
"policyType": "BuiltIn",
"mode": "Indexed",
"description": "Enforce backup for all stoageaccount by backing them up to an existing central recovery services vault in the same location and subscription as the virtual machine. Doing this is useful when there is a central team in your organization managing backups for all resources in a subscription. You can optionally include virtual machines containing a specified tag to control the scope of assignment. See https://aka.ms/AzureVMCentralBackupIncludeTag.",
"metadata": {
"version": "3.0.0",
"category": "Backup"
},
"parameters": {
"vaultLocation": {
"type": "String",
"metadata": {
"displayName": "Location (Specify the location of the VMs that you want to protect)",
"description": "Specify the location of the VMs that you want to protect. VMs should be backed up to a vault in the same location. For example - CanadaCentral",
"strongType": "location"
}
},
"inclusionTagName": {
"type": "String",
"metadata": {
"displayName": "Inclusion Tag Name",
"description": "Name of the tag to use for including VMs in the scope of this policy. This should be used along with the Inclusion Tag Value parameter. Learn more at
},
"defaultValue": ""
},
"inclusionTagValue": {
"type": "Array",
"metadata": {
"displayName": "Inclusion Tag Values",
"description": "Value of the tag to use for including VMs in the scope of this policy (in case of multiple values, use a comma-separated list). This should be used along with the Inclusion Tag Name parameter. Learn more at https://aka.ms/AppCentricVMBackupPolicy."
}
},
"backupPolicyId": {
"type": "String",
"metadata": {
"displayName": "Backup Policy (of type Storage Account from a vault in the location chosen above)",
"description": "Specify the ID of the Azure Backup policy to configure backup of the Storage Account. The selected Azure Backup policy should be of type Azure Storage Account. This policy needs to be in a vault that is present in the location chosen above. For example - /subscriptions/<SubscriptionId>/resourceGroups/<resourceGroupName>/providers/Microsoft.RecoveryServices/vaults/<VaultName>/backupPolicies/<BackupPolicyName>",
"strongType": "Microsoft.RecoveryServices/vaults/backupPolicies"
}
},
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"deployIfNotExists",
"auditIfNotExists",
"disabled"
],
"defaultValue": "deployIfNotExists"
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Storage/storageAccounts"
},
{
"field": "id",
"notContains": "/resourceGroups/databricks-rg-"
},
{
"field": "location",
"equals": "[parameters('vaultLocation')]"
},
{
"field": "[concat('tags[', parameters('inclusionTagName'), ']')]",
"in": "[parameters('inclusionTagValue')]"
}

]
},
"then": {
"effect": "[parameters('effect')]",
"details": {
"roleDefinitionIds": [
"/providers/microsoft.authorization/roleDefinitions/XXXXXXXXXXXX",
"/providers/microsoft.authorization/roleDefinitions/XXXXXXXXXXXX"
],
"type": "Microsoft.RecoveryServices/backupprotecteditems",
"deployment": {
"properties": {
"mode": "incremental",
"template": {
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"backupPolicyId": {
"type": "String"
},
"fabricName": {
"type": "String"
},
"protectionContainers": {
"type": "String"
},
"protectedItems": {
"type": "String"
},
"sourceResourceId": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2017-05-10",
"name": "[concat('DeployProtection-',uniqueString(parameters('protectedItems')))]",
"type": "Microsoft.Resources/deployments",
"resourceGroup": "[first(skip(split(parameters('backupPolicyId'), '/'), 4))]",
"subscriptionId": "[first(skip(split(parameters('backupPolicyId'), '/'), 2))]",
"properties": {
"mode": "Incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"backupPolicyId": {
"type": "String"
},
"fabricName": {
"type": "String"
},
"protectionContainers": {
"type": "String"
},
"protectedItems": {
"type": "String"
},
"sourceResourceId": {
"type": "String"
}
},
"resources": [
{
"type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
"name": "[concat(first(skip(split(parameters('backupPolicyId'), '/'), 8)), '/', parameters('fabricName'), '/',parameters('protectionContainers'), '/', parameters('protectedItems'))]",
"apiVersion": "2016-06-01",
"properties": {
"protectedItemType": "Microsoft.Storage/storageAccounts",
"policyId": "[parameters('backupPolicyId')]",
"sourceResourceId": "[parameters('sourceResourceId')]"
}
}
]
},
"parameters": {
"backupPolicyId": {
"value": "[parameters('backupPolicyId')]"
},
"fabricName": {
"value": "[parameters('fabricName')]"
},
"protectionContainers": {
"value": "[parameters('protectionContainers')]"
},
"protectedItems": {
"value": "[parameters('protectedItems')]"
},
"sourceResourceId": {
"value": "[parameters('sourceResourceId')]"
}
}
}
}
]
},
"parameters": {
"backupPolicyId": {
"value": "[parameters('backupPolicyId')]"
},
"fabricName": {
"value": "AzureStorage"
},
"protectionContainers": {
"value": "[concat('/azfileshare;', resourceGroup().name, ';' ,field('name'))]"
},
"protectedItems": {
"value": "[concat('/azfileshare;', resourceGroup().name, ';' ,field('name'))]"
},
"sourceResourceId": {
"value": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Compute/virtualMachines/',field('name'))]"
}
}
}
}
}
}
}
},
"id": "/providers/Microsoft.Authorization/policyDefinitions/XXXXXXXXXXXXXXX",
"type": "Microsoft.Authorization/policyDefinitions",
"name": "XXXXXXXXXXXXXXX"
}

@nirmalmcse02  Well when I tried to debug I realized there is already some inbuild policies that you can use to backup with a specific tag .

Refer the attached screenshots that I have highlighted

backup.PNG

 

These inbuilt policies are specific to Virtual Machine. However, I am looking for a policy that can Configure backup for Azure File Share Storage with a given tag to an existing recovery services vault.