This article describes how to restore Azure VM data from the recovery points stored in Azure Backup Recovery Services vaults.
Restore optionsAzure Backup provides several ways to restore a VM.
Restore option Details Create a new VM Quickly creates and gets a basic VM up and running from a restore point.You can specify a name for the VM and select the resource group and virtual network (VNet) in which it will be placed. The new VM must be created in the same region as the source VM.
If a VM restore fails because an Azure VM SKU wasn't available in the specified region of Azure, or because of any other issues, Azure Backup still restores the disks in the specified resource group.
Restore disk Restores a VM disk, which can then be used to create a new VM.Azure Backup provides a template to help you customize and create a VM.
The restore job generates a template that you can download and use to specify custom VM settings, and create a VM.
The disks are copied to the Resource Group you specify.
Alternatively, you can attach the disk to an existing VM, or create a new VM using PowerShell.
This option is useful if you want to customize the VM, add configuration settings that weren't there at the time of backup, or add settings that must be configured using the template or PowerShell.
Replace existing You can restore a disk, and use it to replace a disk on the existing VM.The current VM must exist. If it's been deleted, this option can't be used.
Azure Backup takes a snapshot of the existing VM before replacing the disk. The snapshot is copied to the vault and retained in accordance with the retention policy.ã
When you choose a Vault-Standard recovery point, a VHD file with the content of the chosen recovery point is also created in the staging location you specify. Existing disks connected to the VM are replaced with the selected restore point.
After the disk replacement operation is complete, the original disk is retained in the resource group. You can choose to manually delete the original disks if they aren't needed.
Replace existing is supported for unencrypted managed VMs, including VMs created using custom images. It's unsupported for classic VMs, unmanaged VMs, and generalized VMs.
If the restore point has more or less disks than the current VM, then the number of disks in the restore point will only reflect the VM configuration.
Replace existing is also supported for VMs with linked resources, like user-assigned managed-identity or Key Vault.
Cross Region (secondary region) Cross Region restore can be used to restore Azure VMs in the secondary region, which is an Azure paired region.You can restore all the Azure VMs for the selected recovery point if the backup is done in the secondary region.
During the backup, snapshots aren't replicated to the secondary region. Only the data stored in the vault is replicated. So secondary region restores are only vault tier restores. The restore time for the secondary region will be almost the same as the vault tier restore time for the primary region.
This feature is available for the options below:
If the source machine has more than 16 disks, VHDs won't be created in Cross Region Restore.
We don't currently support the Replace existing disks option.
Permissions
Allowed only if the Cross Subscription Restore property is enabled for your Recovery Services vault.
Works with Cross Region Restore and Cross Zonal Restore.
You can trigger Cross Subscription Restore for managed virtual machines only.
Cross Subscription Restore is supported for Restore with Managed System Identities (MSI).
It's unsupported for snapshots tier recovery points.
It's unsupported for unmanaged VMs and ADE encrypted VMs.
Cross Zonal Restore Allows you to restore Azure Virtual Machines or disks pinned to any zone to different available zones (as per the Azure RBAC capabilities) from restore points. Note that when you select a zone to restore, it selects the logical zone (and not the physical zone) as per the Azure subscription you will use to restore to.You can trigger Cross Zonal Restore for managed virtual machines only.
Cross Zonal Restore is supported for Restore with Managed System Identities (MSI).
Cross Zonal Restore supports restore of an Azure zone pinned/non-zone pinned VM from a vault with Zonal-redundant storage (ZRS) enabled. Learn how to set Storage Redundancy.
It's supported to restore an Azure zone pinned VM only from a vault with Cross Region Restore (CRR) (if the secondary region supports zones) or Zone Redundant Storage (ZRS) enabled.
Cross Zonal Restore is supported from secondary regions.
It's unsupported from snapshots restore point.
It's unsupported for Encrypted Azure VMs.
Tip
To receive alerts/notifications when a restore operation fails, use Azure Monitor alerts for Azure Backup. This helps you to monitor such failures and take necessary actions to remediate the issues.
Note
You can also recover specific files and folders on an Azure VM. Learn more.
Storage accountsSome details about storage accounts:
To restore a VM (create a new VM), make sure you have the correct Azure role-based access control (Azure RBAC) permissions for the Restore VM operation.
If you don't have permissions, you can restore a disk, and then after the disk is restored, you can use the template that was generated as part of the restore operation to create a new VM.
Note
The functionality described in the following sections can also be accessed via Backup center. Backup center is a single unified management experience in Azure. It enables enterprises to govern, monitor, operate, and analyze backups at scale. With this solution, you can perform most of the key backup management operations without being limited to the scope of an individual vault.
Select a restore pointTo select a restore point for a VM restore, follow these steps:
Go to Business Continuity Center in the Azure portal and select Recover.
On the Recover pane, select Datasource type as Azure Virtual machines, and then under Protected item, click Select.
On the Select Protected item pane, select a protected VM from the list, and then click Select.
On the Recover pane, select Continue.
On the Restore Virtual Machine pane, under Restore point, click Select.
On the Select restore point pane, select a restore point from the list, and then select OK to use for recovery.
In Restore Virtual Machine, select a restore option:
Create new: Use this option if you want to create a new VM. You can create a VM with simple settings, or restore a disk and create a customized VM.
Replace existing: Use this option if you want to replace disks on an existing VM.
Specify settings for your selected restore option.
Note
Use the Replace existing option only when the Transfer Data to Vault subtask in the job details shows successfully completed. Otherwise, use the Create New option for the latest recovery point restoration.
Create a VMAs one of the restore options, you can create a VM quickly with basic settings from a restore point.
In Restore Virtual Machine > Create new > Restore Type, select Create new virtual machine.
In Virtual machine name, specify a VM that doesn't exist in the subscription.
In Resource group, select an existing resource group for the new VM, or create a new one with a globally unique name. If you assign a name that already exists, Azure assigns the group the same name as the VM.
In Virtual network, select the VNet in which the VM will be placed. All VNets associated with the subscription in the same location as the vault, which is active and not attached with any affinity group, are displayed. Select the subnet.
The first subnet is selected by default.
In Staging Location, specify the storage account for the VM. Learn more.
Choose the required subscription from the Subscription drop-down list to restore an Azure VM to a different subscription.
Azure Backup now supports Cross Subscription Restore (CSR), you can now restore an Azure VM using a recovery point from default subscription to another. Default subscription is the subscription where recovery point is available.
The following screenshot lists all subscriptions under the tenant where you've permissions, which enable you to restore the Azure VM to another subscription.
Choose the required zone from the Availability Zone drop-down list to restore an Azure VM pinned to any zone to a different zone.
Azure Backup now supports Cross Zonal Restore (CZR), you can now restore an Azure VM from the default zone to any available zones. Default zone is the zone in which Azure VM is running.
The following screenshot lists all zones that enable you to restore Azure VM to another zone.
Note
Azure Backup supports CZR only for vaults with ZRS or CRR redundancy.
Select Restore to trigger the restore operation.
Note
As one of the restore options, you can create a disk from a restore point. Then with the disk, you can do one of the following actions:
Under Restore configuration > Create new > Restore Type, select Restore disks.
Under Resource group, select an existing resource group for the restored disks, or create a new one with a globally unique name.
On Staging location, specify the storage account. The template file is stored here, and VHD files are also created in some scenarios. Learn more.
Choose the required subscription from the Subscription drop-down list to restore the VM disks to a different subscription.
Azure Backup now supports Cross Subscription Restore (CSR). Like Azure VM, you can now restore Azure VM disks using a recovery point from default subscription to another. Default subscription is the subscription where recovery point is available.
Choose the required zone from the Availability Zone drop-down list to restore the VM disks to a different zone.
Azure Backup now supports Cross Zonal Restore (CZR). Like Azure VM, you can now restore Azure VM disks from the default zone to any available zones. Default zone is the zone in which the VM disks reside.
Note
Azure Backup supports CZR only for vaults with ZRS or CRR redundancy.
Select Restore to trigger the restore operation.
When your virtual machine uses managed disks and you select the Create virtual machine option, Azure Backup doesn't use the specified storage account. In the case of Restore disks and Instant Restore, the storage account is used only for storing the template. Managed disks are created in the specified resource group. When your virtual machine uses unmanaged disks, they're restored as blobs to the storage account.
While you restore disks for a Managed VM from a Vault-Standard recovery point, it restores the Managed disk and Azure Resource Manager (ARM) templates, along with the VHD files of the disks in staging location. If you restore disks from an Instant recovery point, it restores the Managed disks and ARM templates only.
Note
After the disk is restored, use the template that was generated as part of the restore operation to customize and create a new VM:
Go to the Recovery Services vault, and then select Monitoring > Backup Jobs.
Alternatively, you can go to Business Continuity Center, and then select Monitoring + Reporting > Jobs.
On the Backup Jobs pane, select the relevant restore job.
In Restore, select Deploy Template to initiate template deployment.
Note
For a shared access signature (SAS) that has Allow storage account key access set to disabled, the template won't deploy when you select Deploy Template.
To customize the VM setting provided in the template, select Edit template. If you want to add more customizations, select Edit parameters.
Enter the custom values for the VM, accept the Terms and Conditions and select Purchase.
As one of the restore options, you can replace an existing VM disk with the selected restore point. Review all restore options.
In Restore configuration, select Replace existing.
In Restore Type, select Replace disk/s. This is the restore point that will be used to replace existing VM disks.
In Staging Location, specify a storage account. VHD files are created here in some scenarios. Learn more.
Azure Backup also allows you to configure the access options for the restored disks once the restore operation is complete. You can set the disk access preferences at the time of initiating the restore.
Note
This feature is generally available for backed-up VMs that use private endpoint-enabled disks.
To enable disk access on restored disks during VM restore, choose one of the following options:
Note
The option to choose the network configuration of the restored disks the same as that of the source disks or specify the access from specific networks only is currently not available from Azure PowerShell/ Azure CLI.
Cross Region RestoreAs one of the restore options, Cross Region Restore (CRR) allows you to restore Azure VMs in a secondary region, which is an Azure paired region.
To begin using the feature, read the Before You Begin section.
To see if CRR is enabled, follow the instructions in Configure Cross Region Restore.
View backup items in secondary regionIf CRR is enabled, you can view the backup items in the secondary region.
Note
Only Backup Management Types supporting the CRR feature will be shown in the list. Currently, only support for restoring secondary region data to a secondary region is allowed.
CRR for Azure VMs is supported for Azure Managed VMs (including encrypted Azure VMs). See the management types that support Cross Region Restore.
Restore in secondary regionThe secondary region restore user experience is similar to the primary region restore user experience. When configuring details in the Restore Configuration pane to configure your restore, you're prompted to provide only secondary region parameters.
Currently, secondary region RPO is 36 hours. This is because the RPO in the primary region is 24 hours and can take up to 12 hours to replicate the backup data from the primary to the secondary region.
Screenshot shows how to start secondary region restore of a VM. ":::
Note
Azure zone pinned VMs can be restored in any availability zones of the same region.
In the restore process, you'll see the option Availability Zone. You'll see your default zone first. To choose a different zone, choose the number of the zone of your choice. If the pinned zone is unavailable, you won't be able to restore the data to another zone because the backed-up data isn't zonally replicated. The restore in availability zones is possible from recovery points in vault tier only.
In summary, the Availability Zone will only appear when
Note
Cross region restore jobs once triggered, can't be canceled.
Monitoring secondary region restore jobsFrom the portal, go to Recovery Services vault > Backup Jobs
Select Secondary Region to view the items in the secondary region.
Azure Backup now allows you to perform Cross Subscription Restore (CSR), which helps you to restore Azure VMs in a subscription that is different from the default one. Default subscription contains the recovery points.
This feature is enabled for Recovery Services vault by default. However, there may be instances when you may need to block Cross Subscription Restore based on your cloud infrastructure. So, you can enable, disable, or permanently disable Cross Subscription Restore for the existing vaults by going to Vault > Properties > Cross Subscription Restore.
Note
You're provided with an option to restore unmanaged disks as managed disks during restore. By default, the unmanaged VMs / disks are restored as unmanaged VMs / disks. However, if you choose to restore as managed VMs / disks, it's now possible to do so. These restore operations aren't triggered from the snapshot phase but only from the vault phase. This feature isn't available for unmanaged encrypted VMs.
Restore VMs with special configurationsThere are many common scenarios in which you might need to restore VMs.
Scenario Guidance Restore VMs using Hybrid Use Benefit If a Windows VM uses Hybrid Use Benefit (HUB) licensing, restore the disks, and create a new VM using the provided template (with License Type set to Windows_Server), or PowerShell. This setting can also be applied after creating the VM. Restore VMs during an Azure datacenter disaster If the vault uses GRS and the primary datacenter for the VM goes down, Azure Backup supports restoring backed-up VMs to the paired datacenter. You select a storage account in the paired datacenter, and restore as normal. Azure Backup uses the compute service in the paired region to create the restored VM. Learn more about datacenter resiliency.If the vault uses GRS, you can choose the new feature, Cross Region Restore. This lets you restore to a second region in either full or partial outage scenarios, or even if there's no outage at all.
Bare-metal restore The major difference between Azure VMs and on-premises hypervisors is that there's no VM console available in Azure. A console is required for certain scenarios, such as recovering by using a bare-metal recovery (BMR)-type backup. However, VM restore from the vault is a full replacement for BMR. Restore VMs with special network configurations Special network configurations include VMs using internal or external load balancing, using multiple NICS, or multiple reserved IP addresses. You restore these VMs by using the restore disk option. This option makes a copy of the VHDs into the specified storage account, and you can then create a VM with an internal or external load balancer, multiple NICS, or multiple reserved IP addresses, in accordance with your configuration.To restore VMs with special network configurations, you should use the Restore Disk option. This option creates a copy of the virtual hard disks (VHDs) into the specified storage account. Once the VHDs are copied, you can proceed to create a VM that matches your required network configuration, whether it involves internal or external load balancing, multiple NICs, or multiple reserved IP addresses.
Note that VM NICs won't be created if the machine has Public IP and NAT gateway. Consider this limitation when you plan to restore VMs with special network configurations.
Network Security Group (NSG) on NIC/Subnet Azure VM backup supports backing up and restoring NSG information at vnet, subnet, and NIC level. Zone Pinned VMs If you back up an Azure VM that's pinned to a zone (with Azure Backup), then you can restore it in the same zone where it was pinned. Learn more Restore VM in any availability set When you restore a VM from the portal, there's no option to choose an availability set. A restored VM doesn't have an availability set. If you use the restore disk option, then you can specify an availability set when you create a VM from the disk using the provided template or PowerShell. Restore special VMs such as SQL VMs If you're backing up a SQL VM using Azure VM backup and then use the restore VM option or create a VM after restoring disks, then the newly created VM must be registered with the SQL provider as mentioned here. This will convert the restored VM into a SQL VM. Restore domain controller VMs Scenario Guidance Restore a single domain controller VM in a single domain Restore the VM like any other VM. Note that:From an Active Directory perspective, the Azure VM is like any other VM.
Directory Services Restore Mode (DSRM) is also available, so all Active Directory recovery scenarios are viable. Learn more about backup and restore considerations for virtualized domain controllers.
Restore multiple domain controller VMs in a single domain If other domain controllers in the same domain can be reached over the network, the domain controller can be restored like any VM. If it's the last remaining domain controller in the domain, or a recovery in an isolated network is performed, use a forest recovery. Restore a single domain controller VM in a multiple domain configuration Restore the disks and create a VM by using PowerShell Restore multiple domains in one forest We recommend a forest recovery.For more information, see Back up and restore Active Directory domain controllers.
Restore VMs with managed identitiesManaged identities eliminate the need for the user to maintain the credentials. Managed identities provide an identity for applications to use when connecting to resources that support Microsoft Entra authentication.
Azure Backup offers the flexibility to restore the managed Azure VM with managed identities. You can choose to select system-managed identities or user-managed identities as shown in the figure below. This is introduced as one of the input parameters in the Restore configuration pane of Azure VM. Managed identities are used for accessing the storage accounts and automated cleanup of any resources created during restore process in case of restore failures. These managed identities have to be associated to the vault.
If you choose to select system-assigned or user-assigned managed identities, check for the below actions for managed identity on the target staging Storage Account and Resource Group.
"permissions": [
{
"actions": [
"Microsoft.Authorization/*/read",
"Microsoft.Compute/disks/read",
"Microsoft.Compute/disks/write",
"Microsoft.Compute/disks/delete",
"Microsoft.Compute/disks/beginGetAccess/action",
"Microsoft.Compute/disks/endGetAccess/action",
"Microsoft.Compute/locations/diskOperations/read",
"Microsoft.Compute/virtualMachines/read",
"Microsoft.Compute/virtualMachines/write",
"Microsoft.Compute/virtualMachines/delete",
"Microsoft.Compute/virtualMachines/instanceView/read",
"Microsoft.Compute/virtualMachines/extensions/read",
"Microsoft.Compute/virtualMachines/extensions/write",
"Microsoft.Compute/virtualMachines/extensions/delete",
"Microsoft.Insights/alertRules/*",
"Microsoft.Network/locations/operationResults/read",
"Microsoft.Network/locations/operations/read",
"Microsoft.Network/locations/usages/read",
"Microsoft.Network/networkInterfaces/delete",
"Microsoft.Network/networkInterfaces/ipconfigurations/read",
"Microsoft.Network/networkInterfaces/join/action",
"Microsoft.Network/networkInterfaces/read",
"Microsoft.Network/networkInterfaces/write",
"Microsoft.Network/networkSecurityGroups/read",
"Microsoft.Network/networkSecurityGroups/securityRules/read",
"Microsoft.Network/publicIPAddresses/delete",
"Microsoft.Network/publicIPAddresses/join/action",
"Microsoft.Network/publicIPAddresses/read",
"Microsoft.Network/publicIPAddresses/write",
"Microsoft.Network/virtualNetworks/read",
"Microsoft.Network/virtualNetworks/subnets/join/action",
"Microsoft.Network/virtualNetworks/subnets/read",
"Microsoft.Resources/deployments/*",
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.Storage/checkNameAvailability/read",
"Microsoft.Storage/storageAccounts/blobServices/containers/delete",
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
"Microsoft.Storage/storageAccounts/blobServices/containers/write",
"Microsoft.Storage/storageAccounts/listKeys/action",
"Microsoft.Storage/storageAccounts/read",
"Microsoft.Storage/storageAccounts/write"
],
"notActions": [],
"dataActions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
],
Or, add the VM restore operator role assignment on the staging location (Storage Account) and target Resource Group for the successful restore operation.
You can also select the user-managed identity by providing the input as their MSI Resource ID as provided in the figure below.
Note
The support is available for only managed VMs, and not supported for classic VMs and unmanaged VMs. For the storage accounts that are restricted with firewalls, system MSI is only supported.
Cross Region Restore isn't supported with managed identities.
Currently, this is available in all Azure public and national cloud regions.
Track the restore operationAfter you trigger the restore operation, the backup service creates a job for tracking. Azure Backup displays notifications about the job in the portal. If they aren't visible, select the Notifications symbol, and then select More events in the activity log to see the Restore Process Status.
Track restore as follows:
To view operations for the job, select the notifications hyperlink. Alternatively, in the vault, select Backup jobs, and then select the relevant VM.
To monitor restore progress, select any restore job with a status of In-progress. This displays the progress bar, which displays information about the restore progress:
There are a few things to note after restoring a VM:
Extensions present during the backup configuration are installed, but not enabled. If you see an issue, reinstall the extensions. In the case of disk replacement, reinstallation of extensions is not required.
If the backed-up VM had a static IP address, the restored VM will have a dynamic IP address to avoid conflict. You can add a static IP address to the restored VM.
A restored VM doesn't have an availability set. If you use the restore disk option, then you can specify an availability set when you create a VM from the disk using the provided template or PowerShell.
If you use a cloud-init-based Linux distribution, such as Ubuntu, for security reasons the password is blocked after the restore. Use the VMAccess extension on the restored VM to reset the password. We recommend using SSH keys on these distributions, so you don't need to reset the password after the restore.
If you're unable to access a VM once restored because the VM has a broken relationship with the domain controller, then follow the steps below to bring up the VM:
Attach OS disk as a data disk to a recovered VM.
Manually install VM agent if Azure Agent is found to be unresponsive by following this link.
Enable Serial Console access on VM to allow command-line access to VM
bcdedit /store <drive letter>:\boot\bcd /enum
bcdedit /store <VOLUME LETTER WHERE THE BCD FOLDER IS>:\boot\bcd /set {bootmgr} displaybootmenu yes
bcdedit /store <VOLUME LETTER WHERE THE BCD FOLDER IS>:\boot\bcd /set {bootmgr} timeout 5
bcdedit /store <VOLUME LETTER WHERE THE BCD FOLDER IS>:\boot\bcd /set {bootmgr} bootems yes
bcdedit /store <VOLUME LETTER WHERE THE BCD FOLDER IS>:\boot\bcd /ems {<<BOOT LOADER IDENTIFIER>>} ON
bcdedit /store <VOLUME LETTER WHERE THE BCD FOLDER IS>:\boot\bcd /emssettings EMSPORT:1 EMSBAUDRATE:115200
When the VM is rebuilt use Azure portal to reset local administrator account and password
Use Serial console access and CMD to disjoin VM from domain
cmd /c "netdom remove <<MachineName>> /domain:<<DomainName>> /userD:<<DomainAdminhere>> /passwordD:<<PasswordHere>> /reboot:10 /Force"
Once the VM is disjoined and restarted, you'll be able to successfully RDP to the VM with local admin credentials and rejoin VM back to domain successfully.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4