Public preview: Immutable vaults with Azure Backup
Published Oct 26 2022 10:35 AM 1,692 Views

Azure Backup recently launched the public preview of immutable vaults that can help you protect your backup data better against ransomware attacks and other malicious actors. Immutable vaults protect your backups by blocking any operations that could lead to loss of recovery points if misused. Further, you can lock the immutability setting to make it irreversible, which can prevent malicious actors from disabling immutability and deleting backups.

Immutability is supported for Recovery Services vaults as well as Backup vaults.

How it works

Backup data stored using Azure Backup is not accessible directly and the only way to access or manage this data is through the vault. Immutable vaults help you by preventing any operations that, if used by malicious actors, could lead to the loss of backups. The Immutable vault setting on your vault enables you to block such operations to ensure that your backup data is protected, even if any malicious actors try to delete them to affect the recoverability of data.

 

The operations following are protected when using immutable vaults:

 

For Recovery Services vaults:

Operation type

Description

Stop protection with delete data

A protected item can't have its recovery points deleted before their respective expiry date. However, you can still stop protection of the instances while retaining data forever or until their expiry.

Modify backup policy to reduce retention

Any actions that reduce the retention period in a backup policy are disallowed on Immutable vault. However, you can make policy changes that result in the increase of retention. You can also make changes to the schedule of a backup policy.

Change backup policy to reduce retention

Any attempt to replace a backup policy associated with a backup item with another policy with retention lower than the existing one is blocked. However, you can replace a policy with the one that has higher retention.

 

For Backup vaults:

Operation type

Description

Stop protection with delete data

A protected item can't have its recovery points deleted before their respective expiry date. However, you can still stop protection of the instances while retaining data forever or until their expiry.

 

Enabling immutability and making it irreversible

Enabling a vault to be immutable restricts performing certain operations on your backups. So, Azure Backup provides you an opportunity to ensure all your configurations are as per your requirements before you lock immutability to make it irreversible. Hence, when it comes to immutability your vault can have one of the following states for the setting:

 

State of Immutable vault setting

Description

Disabled

The vault doesn't have immutability enabled and no operations are blocked.

Enabled

The vault has immutability enabled and doesn't allow operations that could result in loss of backups.

However, the setting can be disabled.

Enabled and locked

The vault has immutability enabled and doesn't allow operations that could result in loss of backups.

As the Immutable vault setting is now locked, it can't be disabled.

Note that immutability locking is irreversible, so ensure that you take a well-informed decision when opting to lock.

 

You can enable immutability and then make it irreversible (or ‘lock’ it) through vault properties.

UtsavRaghuvanshi_2-1666805568409.png

 

Learn more

Check out this article to learn more about immutable vaults for Azure Backup.

Co-Authors
Version history
Last update:
‎Oct 26 2022 10:35 AM
Updated by: