Securing Confidential VM Backups with Azure Recovery Services Vault and Private Endpoints
When working with Confidential VMs (CVMs) in Azure, ensuring secure backups is just as important as protecting workloads in use. Confidential VMs use hardware-based Trusted Execution Environments (TEEs) such as AMD SEV-SNP or Intel TDX to keep your data safe. But how do you securely back up this data without exposing it to the public internet? The answer lies in combining Azure Recovery Services Vault (RSV) with Private Endpoints. In this blog, we’ll walk through why this setup matters, how to configure it, and what challenges you should watch out for. Note: This blog specifically deals with CVMs encrypted with Confidential OS Encryption on the OS Disk. As of now, Azure Backup for CVMs is in Private Preview, so make sure to engage with your Microsoft Account Team or Product Team for access. Why Use Private Endpoints for RSV? By default, the Recovery Services vault communicates over public endpoints. With private endpoints, all traffic between your Confidential VM and RSV flows over the secure Microsoft backbone instead of the public internet. This adds an extra layer of isolation and protection — a perfect match for sensitive workloads. What You’ll Need (Prerequisites) Before jumping in, make sure you have: An Azure Subscription and appropriate permissions (Owner/Contributor for RSV, DNS Zone Contributor for DNS). A Confidential VM on supported SKUs. A Recovery Services Vault in the same or a peered region. A Virtual Network and Subnet: Use a dedicated subnet for private endpoints. A private endpoint connection for Backup uses 11 private IPs (including Azure Backup storage). This may be higher in certain regions. Recommended subnet size: /25 to /27 to ensure sufficient private IP availability. Private DNS Zones: privatelink.backup.windowsazure.com (for the vault itself) privatelink.blob.core.windows.net (staging and recovery data) privatelink.queue.core.windows.net (backup operations queue) privatelink.table.core.windows.net (metadata storage) Azure Backup for CVMs supports only the 3-blob layout, which is now generally available. As a result, all new deployments on versions v5 and v6 SKUs will have 3-blob configuration by default instead of the previous 2-blob setup. Older deployments that did not enable the Preview Feature may need to be redeployed to align with this change. Azure Backup Private Preview Feature enabled on the subscription-level in collaboration with the Azure Product Team. Up-to-date Backup Extension on the VM. Step-by-Step: Configuring Backup with Private Endpoints Request Product Team Enablement: Work with Microsoft support/product team to enable the Azure Backup Private Preview Feature for your subscription. Create the Recovery Services Vault in the desired region. Add a Private Endpoint: Go to RSV → Networking → Private Endpoint connections. Select your VNet and subnet (ensure enough private IPs: /25 to /27 recommended). Link to the required private DNS zones. Enable Backup on the Confidential VM: Open the VM → Backup. Select the RSV. Choose or create an Enhanced policy (required for CVMs). Trigger the initial backup. Key Considerations for Confidential VM Backup Enhanced Policies Only: CVM backup supports only Enhanced policies. Backup support for CVM with confidential OS disk encryption using CMK is only available with Enhanced policies. Zone-Redundant Recovery Services Vault (ZRS): Consider deploying RSV as ZRS if you want to restore CVMs across zones. Restores from other zones are possible only via vault; snapshot restores are not supported across zones. CVM Backup with CMK Support: Currently available only under Private Preview on an enrollment basis. Key Vault and Managed HSM Permissions: When configuring via Azure Portal, access to Key Vault/Managed HSM is granted automatically. When using PowerShell, CLI, or REST API, access issues occur because Azure Backup requires explicit permissions. Fix: Assign Permissions to Azure Backup: For Key Vault: Grant Get, List, Backup key permissions (no secret permissions needed). For Managed HSM: Go to Managed HSM → Local RBAC → Add Role Assignment. Assign one of the following: Built-in Role: Managed HSM Crypto User Custom Role: Ensure dataActions include: Microsoft.KeyVault/managedHsm/keys/read/action Microsoft.KeyVault/managedHsm/keys/backup/action Set scope to the specific key (or All Keys). Assign role to Backup Management Service. Once permissions are configured, proceed with CVM backup setup as usual. Restore Options and Limitations When restoring a Confidential VM, Azure Backup provides several restore paths — each with certain caveats due to the confidential computing model: Restore to Original Location You can restore the CVM directly to the same subscription, resource group, and network configuration. Ideal for operational recovery after accidental deletion or corruption. Restore to Alternate Location You can restore the backup to a different resource group, virtual network, or availability zone. Limitations: Only supported when RSV is deployed as Zone-Redundant (ZRS). Snapshot restore is not supported when restoring to other zones. Disk-Level Restore Allows restoring specific managed disks (OS or data disks) from the backup vault. Restored disks can be used to recreate CVMs manually. Limitations: Replacement of OS Disk on the existing VM is not supported. Point-in-Time Restore (Enhanced Policy Only) Available for Enhanced Backup Policies with configurable retention settings. Restore Limitations Encryption Constraints: Restores for CVMs with CMK require the same Key Vault access and permissions to be valid at restore time. Private DNS Dependency: Incorrect or missing DNS resolution for blob or backup endpoints can cause restore failures. Feature Availability: All restore capabilities mentioned above are still evolving under the Azure Backup Private Preview program. Security Benefits Network Isolation: All communication between CVMs, the Recovery Services Vault, and backup storage occurs over private IPs using private endpoints — no exposure to the public internet. End-to-End Encryption: Backup data is encrypted both at rest and in transit. Use Customer-Managed Keys (CMK) in Azure Key Vault or Managed HSM for greater control over encryption. Role-Based Access Control (RBAC): Fine-grained access management ensures only authorized users and services can trigger or restore backups. Managed Identities for Authentication: Reduces key management complexity and enhances security posture. Known Issues and Limitations DNS Misconfiguration: Missing or misconfigured private DNS zones for backup, blob, queue, or table endpoints often lead to failed backups or restores. Limited Regional Support: Confidential VM backups with private endpoints are currently available in selected Azure regions only. Extension Compatibility: Ensure that the latest Azure Backup extension version is installed on the CVM. Older versions may not support CVM encryption. Feature Dependencies: Azure Backup for CVMs (Private Preview) must be manually enabled at the subscription level by the Azure Product Team. Performance Overhead: Due to attestation and encryption validation, backup operations may experience slight latency. Best Practices Test Restore Scenarios Regularly: Validate both backup and restore processes to ensure end-to-end functionality. Subnet Planning: Reserve adequate IP addresses in your subnet (/25 or /27) to accommodate private endpoints. ZRS Deployment: Use Zone-Redundant Recovery Services Vault (ZRS) for better resiliency and zone-to-zone restore capability. Use Enhanced Backup Policies: Enhanced policies ensure point-in-time recovery and support for CMK-based encryption. DNS Hygiene: Keep private DNS zones properly configured and linked to ensure uninterrupted connectivity. Permission Management: Verify Key Vault and Managed HSM permissions before initiating backup/restore through PowerShell or REST API. Network Segmentation: Use dedicated subnets for private endpoints to avoid IP conflicts and simplify network management. Automate with IaC: Use Bicep or Terraform templates for repeatable, auditable deployments of RSVs, private endpoints, and DNS configurations. Monitor Health and Alerts: Enable Azure Monitor and Backup Center to track job statuses, failures, and performance. Engage Product Team Early: Contact the Microsoft Product Team early in your project to ensure required preview feature (Azure Backup for CVMs) is enabled in time. Final Thoughts Backing up Confidential VMs with Azure Recovery Services vault over private endpoints gives you the best of both worlds: confidential computing protections for your workloads and secure, compliant backups that never leave the private network. By carefully planning DNS, subnet sizing, enabling subscription features with product team help, and configuring permissions properly, you can avoid common pitfalls and strengthen your data protection strategy. Note: This blog specifically deals with CVMs encrypted with Confidential OS Encryption on the OS Disk. Tip: If you’re just getting started, reach out to the Azure Product Team to enable the required features, deploy a test CVM, link it to an RSV with private endpoints, and run a backup/restore cycle to validate your configuration end-to-end.Now in public preview: Automatic lowering of a user's Raised Hand after speaking
Description To reduce the number of stale raised hands in meetings, we now suggest users to lower their raised hand after we detect they spoke in the meeting. If users don't take any action on the suggestion notification, we'll automatically lower their hand. This should ensure smoother meeting facilitation for organizers and presenters. Flighting status Available to everyone in Public Preview channel. How to enable Users who raise their hand in a Teams meeting and speak in the meeting will see a notification informing them that their hand will automatically be lowered soon. They will be able to choose to keep their hand raised. If the user doesn't take action on the notification, their hand will automatically lower. This should ensure smoother meeting facilitation for organizers and presenters. Note 1: If you need information about enabling the public preview itself, see “Enable the public preview for Teams” below. Note 2: To be able to use this feature, user needs to be in Public Preview. Other meeting participants are not required to be in Public Preview. Supported clients and platforms Windows macOS iOS Android Linux Google Chrome Firefox Safari Microsoft Edge Yes Yes Known issues None Known limitations Users will not see the notification and their hand will not be automatically lowered if Noise suppression is turned off in their Teams devices settings. Please note that Noise suppression is automatically turned off when your device has high CPU usage in order to preserve resources. Enable your Teams client for the public preview First, IT admins need to set an update policy that turns on Show preview features. Learn how at Public preview in Microsoft Teams - Microsoft Teams | Microsoft Docs. Users then choose to join the public preview individually. Learn how at Get early access to new Teams features - Office Support (microsoft.com) Send us your feedback Got feedback on features in the public preview or other areas of Teams? Let us know straight from Teams via Help > Give feedback. This is on the bottom left of your client. Thank you, Preview Team Quality & Customer Obsession, Microsoft TeamsInbound Screening & PCI-DSS
PCI-DSS frowns on having credit card numbers and related information in systems not otherwise in scope. Yet we sometimes have law enforcement asking for us for researching by these very terms; they send these sometimes via E-mail. I wonder therefore whether Exchange can screen using DLP policies, with the intent of adding controls, such as masking or adding "no forwarding, no printing," and so on. Possible? Advisable?Now in public preview: Pop out shared content into a separate window
Description Microsoft Teams now supports the ability to pop out shared content (shared screen, PowerPoint Live and Whiteboard) into a separate window while in meetings. Flighting status Available to everyone in Public Preview channel. How to enable To pop out content from meeting stage and use more monitors/screens during meetings: Join a Teams meeting from a Teams desktop client (Windows or Mac) as an attendee or presenter . When content (shared screen, PowerPoint Live or Whiteboard) is shared by another presenter in the meeting, click the "Pop out" button in the meeting toolbar to pop out the content into a separate window. You can pop in the window with shared content by closing it (by pressing "X" button). When the presenter stops sharing content, you can also click on "Dismiss" button which appears below a message in the pop out window informing you that content sharing has ended. Note 1: If you need information about enabling the public preview itself, see “Enable the public preview for Teams” below. Note 2: To be able to use this feature, users need to be in Public Preview. Users not in Public Preview will not be able to pop out shared content into a separate window. Windows macOS iOS Android Linux Google Chrome Firefox Safari Microsoft Edge Internet Explorer Yes Yes Known issues None Known limitations Majority of modern devices with medium and high-end hardware will support popping out content into a shared window while in meetings. As Microsoft continues to fine tune the experience, there may be more support in the future for other types of devices with less performant hardware. Also, we will list the specific supported hardware configuration at GA. Enable your Teams client for the public preview First, IT admins need to set an update policy that turns on Show preview features. Learn how at Public preview in Microsoft Teams - Microsoft Teams | Microsoft Docs. Users then choose to join the public preview individually. Learn how at Get early access to new Teams features - Office Support (microsoft.com) Send us your feedback Got feedback on features in the public preview or other areas of Teams? Let us know straight from Teams via Help > Give feedback. This is on the bottom left of the your client. Thank you, Preview Team, Jan_Steberl Quality & Customer Obsession, Microsoft TeamsPostgreSQL 17 Preview on Azure Postgres Flexible Server
We recently announced the 𝗽𝗿𝗲𝘃𝗶𝗲𝘄 𝗼𝗳 𝗣𝗼𝘀𝘁𝗴𝗿𝗲𝗦𝗤𝗟 𝟭𝟳 on Azure Database for PostgreSQL - 𝗙𝗹𝗲𝘅𝗶𝗯𝗹𝗲 𝗦𝗲𝗿𝘃𝗲𝗿! This release brings exciting new features like improved query performance, dynamic logical replication, enhanced JSON functions, and more—all backed by Azure’s reliable managed services. Try out the preview now and share your feedback! For details, read the complete blog post👉 https://techcommunity.microsoft.com/t5/azure-database-for-postgresql/postgresql-17-preview-on-azure-postgres-flexible-server/bc-p/4263877#M474 We’d love to hear your thoughts—feel free to share feedback or questions in the comments! #PostgreSQL #AzurePostgres #PGConfNYC #Database #OpenSource
Screen Sharing not working in latest version
Hi all, Anyone else, that has problem with screen sharing in the current preview version? My Teams Version: 25007.606.3361.4724 My Clientversion: 49/25010620407 If i share my screen (regardless if full monitor or single app), the other users only see, that I am trying to share something, but never get the content visible. The only users that can see my content shared, are using the preview version as well. I tested it with one normal user and one with preview in the same call. The latter one was able to see the screen, the other one not. I have found a workaround right now: If I am in a call with a normal user, I can share the screen, if we start recording for a few seconds and stop it then. As long as recording has run at least for a few seconds, everyone can see my shared screen. I faced that issue for the first time last week.Now in public preview: Pin a Chat Message
Description Users can now pin a specific message, providing chat members with quick access to critical content at anytime. Any member of a chat will be able to pin/unpin any specific chat message to the top of the chat header, for all members to see. Users can click on the pinned message to go to the original message in the chat thread. Currently, only a single message can be pinned at a time. Flighting status Available to everyone now How to enable To use this feature, a user selects the 'Pin' option from the 'more options' (...) menu when hovering over the chat message they want to pin. User 1 writes multiple messages to user 2. The message is pinned to the top of the chat and remains pinned while users continue to chat. Any user can click the pinned message to view it, or unpin it for the entire chat members. There will be a warning message followed to confirm unpinning. The user can replace the pinned message with another message by pinning the new message. When replacing a pinned message the user will get the following warning. Users should be aware of the following behaviors: Pinned messages will appear at the top banner of a chat thread in both the main window and if the chat is popped-out into a separate window. Users can pin all messages sent in a chat thread, including extensibility messages. Any user can pin and unpin a message in chat conversations they are members of - providing they are not a guest user. Users will be able to see a short context of the message in the banner: sender name, sent time and date, preview of the message up to X characters. Note 1: If you need information about enabling the public preview itself, see “Enable the public preview for Teams” below. Microsoft 365 workloads and dependencies Product, workload, or area Dependency (Yes/No) If yes, version requirements and other dependencies Exchange No Sharepoint, files No Skype for Business No Outlook add-in No Azure AD No OneDrive No Office No Supported clients and platforms Windows 10 macOS iOS Android Linux Chrome Firefox Safari Edge Yes Yes - - Yes Yes Yes Yes Yes Known issues System message showing who in the chat pinned/unpinned a message will be available soon If you have issues seeing your pinned content show up properly please submit feedback We’ve had some reports that switching between chats will help load content Known limitations Users can pin a single message in a chat thread. Enable your Teams client for the public preview First, IT admins need to set an update policy that turns on Show preview features. Learn how at Public preview in Microsoft Teams - Microsoft Teams | Microsoft Docs. Users then choose to join the public preview individually. See Get early access to new Teams features - Office Support (microsoft.com) for instructions. Summary of public preview features For a history of features in the Office and Teams public previews, see Release Notes Current Channel (Preview) - Office release notes | Microsoft Docs. Send us your feedback Got feedback on features in the public preview or other areas of Teams? Let us know straight from Teams via Help > Give feedback. This is on the bottom left of the your client. Thank you, Preview Team, Jason_Schumacher Quality & Customer Obsession, Microsoft TeamsNow in public preview: Detailed call history
Description We have updated the previous 1 to 1 call history to now involve richer context and details. Now in Call History, a user can see group calls and all participants involved, calls that were transferred, and calls that were forwarded. Additionally, there has been added a new Timeline section where further details on each call can be seen after clicking on the call record in the history section. In the Timeline, a user will get further context on who answered the call, and the duration and start and end times of the call as well. Flighting status Started flighting. Rollout estimated to be complete by Friday October 15 th 2022. How to enable Detailed Call History is automatically available to every user in public preview. Note 1: If you need information about enabling the public preview itself, see “Enable your Teams client for the public preview” below. Note 2: User needs to be in Public Preview to be able to use this feature. Supported clients and platforms Windows macOS iOS Android Linux Edge Chrome Safari Firefox Yes Yes NA NA NA Yes Yes NA NA Available on desktop and web. Known limitations The feature is scoped to transferred, forwarded, and group calls currently. Merged calls, parked calls, and hold/resume, call queues, and delegate calls are out of scope. Enable your Teams client for the public preview First, IT admins need to set an update policy that turns on Show preview features. Learn how at Public preview in Microsoft Teams - Microsoft Teams | Microsoft Docs. Users then choose to join the public preview individually. See Get early access to new Teams features - Office Support (microsoft.com) for instructions. Send us your feedback Got feedback on features in the public preview or other areas of Teams? Let us know straight from Teams via Help > Give feedback. This is on the bottom left of your client. Thank you, Preview Team Quality & Customer Obsession, Microsoft Teams
