This guest post is authored by Swathi Dhanwada, Customer Engineer 2, who is frequently seen answering Azure Backup community queries.
Azure Backup supports multiple backups of Azure Virtual Machines per day using Enhanced Policy. For hourly backup, the minimum RPO is 4 hours and the maximum is 24 hours. You can set the backup schedule to 4, 6, 8, 12, and 24 hours respectively. Learn how to back up an Azure VM using Enhanced policy. This feature is only available to unprotected VMs that are new to Azure Backup. VMs that are already protected with existing policy can't be moved to Enhanced policy. To overcome this, you can run an multiple on-demand backup of a VM per day after you set up its protection. Keep these details in mind:
- If the initial backup is pending, on-demand backup creates a full copy of the VM in the Recovery Services vault.
- If the initial backup is complete, an on-demand backup will only send changes from the previous snapshot to the Recovery Services vault. That is, later backups are always incremental.
- You can’t trigger on-demand backups by disabling scheduled backup.
Below are the steps to automate the on-demand backup for azure virtual machines using Azure Automation.
Step1
Create an Automation resource with system managed identity. To assign permissions to managed identities, complete the following steps:
Sign in to your Azure subscription
`$sub = Get-AzSubscription -ErrorAction SilentlyContinue
if(-not($sub))
{
Connect-AzAccount
}`
If you have multiple subscriptions, set the one to use
Select-AzSubscription -SubscriptionId <SUBSCRIPTIONID>
- Provide an appropriate value for the following variables and then run the script:
$resourceGroup = "resourceGroupName"
$automationAccountId = "xAutomationAccount"
- Use the PowerShell
cmdlet New-AzRoleAssignment to assign a role to the system-assigned managed identity:
$role1 = "Backup Operator"
$SAMI = (Get-AzAutomationAccount -ResourceGroupName $resourceGroup
-Name $automationAccount).Identity.PrincipalId
New-AzRoleAssignment
-ObjectId $SAMI
-ResourceGroupName $resourceGroup
-RoleDefinitionName $role1
Step2
Verify if required modules are imported to the Automation resource. If not, import the following modules from the Modules gallery in the order given below:
Step3
Create PowerShell Runbooks in the Automation Resource. You can create multiple Runbooks based on which set of virtual machines you want to protect.
Step4
Edit the Runbook and write script to choose which virtual machines to take a backup. You can create scripts that suit your requirements.
Script to trigger on demand backup for single vm
Get-AzRecoveryServicesVault -Name "<recoveryvault name>" | Set-AzRecoveryServicesVaultContext
$namedContainer = Get-AzRecoveryServicesBackupContainer -ContainerType AzureVM -FriendlyName "<azurevmname>"
$item = Get-AzRecoveryServicesBackupItem -Container $namedContainer -WorkloadType AzureVM
$job = Backup-AzRecoveryServicesBackupItem -Item $item
Step5
- Schedule the Runbook. While scheduling the Runbook, you can pass on the parameters required for the PowerShell Script.
- The sample script (see attachment ScriptForAutomatingOnDemandAzureBackup.docx) takes the retention as an input. So, if you need to schedule a weekly snapshot and retain for 8 weeks, create a weekly schedule as mentioned below and specify the retention as 56 days (8 weeks). You can create monthly and yearly schedules (run every 12 months) in a similar manner. You can monitor the success/failure of these backups using the “Jobs” tab of Runbooks.
Reference Documents:
