Skip to content

Azure/Basic-VM-Protection

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
scripts
scripts
 
 
.gitignore
.gitignore
 
 
FAQ.md
FAQ.md
 
 
LICENSE
LICENSE
 
 
README.md
README.md
 
 
SECURITY.md
SECURITY.md
 
 

Repository files navigation

Basic VM Protection for Azure Virtual Machines (Private Preview)

Lightweight VM resiliency for everyday workloads: basic protection that keeps business continuity simple and cost effective. Basic VM Protection captures automatic, crash-consistent restore points for a VM and its attached disks, stored in your own subscription, so you can recover from an accidental delete, a bad patch, or disk corruption without standing up a Recovery Services vault or authoring a backup policy.

Private preview. This repository hosts the end-user docs and the PowerShell scripts / REST API wrappers for the preview. Preview is for validation in non-production environments only. Some values below are subject to change before public preview / GA.

Contents

Path What it is
README.md This overview: features, prerequisites, get started, restore, cost, comparison.
FAQ.md Full reference FAQ (eligibility, RPO/retention, RBAC, cost model, upgrade path).
Enable-BasicVMBackup.ps1 PowerShell wrapper to enable/disable basic protection on a VM.
Restore-VMFromRestorePoint.ps1 PowerShell orchestration to restore a VM from a restore point.
LICENSE MIT license.

Key features

Feature Description
Cost advantage Pay only for snapshot storage (Managed Disks pricing): ~$0.05/GB per month (about $35/month for a typical VM with 700 GB of storage), with no extra licensing or support fees.
Recovery point objective (RPO) Rapid recovery with up to a 24-hour RPO.
Consistency Multi-disk crash-consistent snapshots of VM configuration and attached disks.
Retention 3-day retention with automatic pruning.
Sovereignty Restore points are created in your own subscription.

Why Basic VM Protection

Azure Backup and Azure Site Recovery already exist, but they carry a Recovery Services vault, backup policy, and per-instance cost that keep many VMs (dev, test, and cost-sensitive workloads) unprotected. Basic VM Protection is the always-on baseline with near-zero config and storage-only cost, so every VM can have a recovery path:

  • Protection lives on the VM. No vault to stand up, no policy to author.
  • Restore points stay in your subscription. Encrypted and in-region.
  • Storage-only cost. No license or support fee; you pay only for incremental snapshot storage.

Azure Backup and Azure Site Recovery remain the right choice for richer policy, application-consistent backups, long retention, cross-region DR, and cyber-resiliency. See the comparison below and the upgrade path.

Prerequisites

Prerequisite Description
Sign up for preview Sign up via this form. You'll receive an email once enrolled (usually within 5 business days).
Single-instance VMs VMs not associated with VM scale sets (Uniform or Flex).
Supported regions Available in all Azure public cloud regions.
Premium-storage-capable VM size See the PowerShell check below. Output True indicates support.(1)

NOTE

  • (1) Most VM size families will be supported in a later release without a premium-storage dependency.

Check premium-storage support:

(Get-AzComputeResourceSku -Location "eastus" | Where-Object { $_.ResourceType -eq 'virtualMachines' -and $_.Name -eq 'Standard_D2s_v3' }).Capabilities | Where-Object { $_.Name -eq 'PremiumIO' } | Select-Object -ExpandProperty Value

Currently unsupported configurations

Configuration Supported
Premium Storage Supported
Premium Storage caching Supported
Live Migration Supported
Accelerated Networking Supported
Ephemeral OS Disk Not supported
Write Accelerator Not supported
Shared disk Not supported
VM scale sets (Uniform or Flex) Not supported
Premium SSD v2 disks Not supported
Ultra SSD disks Not supported

Get started

In this preview you can enable a basic backup policy on an existing or new VM that meets the supported configurations.

Option 1: PowerShell script (recommended)

IMPORTANT DISCLAIMER

This script is not supported under any Microsoft standard support program or service. It is provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the script and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the script be liable for any damages whatsoever arising out of the use of or inability to use the script or documentation, even if Microsoft has been advised of the possibility of such damages.

Prerequisites

Install-Module -Name Az.Accounts, Az.Compute -Scope CurrentUser
Connect-AzAccount

Steps

  1. Download Enable-BasicVMBackup.ps1 from this repository.

  2. Enable basic backup protection:

    .\Enable-BasicVMBackup.ps1 `
    -SubscriptionId "your-subscription-id" `
    -ResourceGroupName "your-resource-group" `
    -VMName "your-vm-name" `
    -Enable $true

  3. Verify restore points: the first restore point is created 3–6 hours after enabling. In the Azure portal, go to your VM → Restore Points.

  4. Disable when done testing:

    .\Enable-BasicVMBackup.ps1 `
    -SubscriptionId "your-subscription-id" `
    -ResourceGroupName "your-resource-group" `
    -VMName "your-vm-name" `
    -Enable $false

  5. Clean up: after disabling, manually delete the restore points (VM → Restore Points) to avoid incurring storage cost.

Script parameters

Parameter Required Description Valid values
SubscriptionId Yes Azure subscription ID Any valid subscription GUID
ResourceGroupName Yes Resource group containing the VM Any existing resource group
VMName Yes Virtual machine name Any existing VM name
Enable Yes Enable or disable basic backup $true or $false

Option 2: REST API directly

Prerequisites

# Azure CLI: https://learn.microsoft.com/cli/azure/install-azure-cli
az login

Steps

  1. Get an access token:

    az account get-access-token --resource https://management.azure.com --query accessToken -o tsv

  2. Set variables:

    SUBSCRIPTION_ID="your-subscription-id"
RESOURCE_GROUP="your-resource-group"
VM_NAME="your-vm-name"
LOCATION="eastus"   # the VM's region (all Azure public cloud regions supported)
ACCESS_TOKEN="your-access-token-from-step-1"

  3. Enable basic backup protection (set isEnabled to false to disable):

    curl -X PATCH \
  "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Compute/virtualMachines/${VM_NAME}?api-version=2025-04-01" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "location": "'"${LOCATION}"'",
    "properties": {
      "resiliencyProfile": {
        "periodicRestorePoints": { "isEnabled": true }
      }
    }
  }'

    PowerShell equivalent:

    $token = (az account get-access-token --resource https://management.azure.com --query accessToken -o tsv)
$uri = "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.Compute/virtualMachines/$($VM_NAME)?api-version=2025-04-01"
$headers = @{ "Authorization" = "Bearer $token"; "Content-Type" = "application/json" }
$body = @{
    location = "$LOCATION"
    properties = @{ resiliencyProfile = @{ periodicRestorePoints = @{ isEnabled = $true } } }
} | ConvertTo-Json -Depth 10
Invoke-RestMethod -Uri $uri -Method Patch -Headers $headers -Body $body

  4. Verify restore points (VM → Restore Points), then disable and clean up as in Option 1.

API reference

  • API version: 2025-04-01
  • Endpoint: PATCH https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines/{vmName}?api-version=2025-04-01
  • Property: properties.resiliencyProfile.periodicRestorePoints.isEnabled (true / false)

Important notes

  • The first restore point is created 3–6 hours after enabling.
  • In the current preview, retention is up to 10 restore points (this becomes 3-day retention at public preview); frequency is 24 hours.
  • Frequency and retention are not customer-editable. Share concerns via the feedback form.
  • After validating, turn the feature off (PowerShell script or PATCH API with isEnabled: false) and delete restore points in your subscription to avoid incurring cost.

Restore a VM from a restore point

Restore-VMFromRestorePoint.ps1 automates the full restore: it discovers the restore point collection, restores OS and data disks, deallocates the VM, swaps/attaches the restored disks, and starts the VM.

Prerequisites

Install-Module -Name Az.Accounts, Az.Compute -Scope CurrentUser
Connect-AzAccount

The VM must have at least one restore point (allow 3–6 hours after enabling).

Common usage

# Restore from the latest restore point
.\Restore-VMFromRestorePoint.ps1 -SubscriptionId "sub" -ResourceGroupName "rg" -VMName "vm"

# Restore from a specific restore point
.\Restore-VMFromRestorePoint.ps1 -SubscriptionId "sub" -ResourceGroupName "rg" -VMName "vm" -RestorePointName "rp-name"

# Keep original disks after restore
.\Restore-VMFromRestorePoint.ps1 -SubscriptionId "sub" -ResourceGroupName "rg" -VMName "vm" -KeepOriginalDisks

# Preview changes without executing
.\Restore-VMFromRestorePoint.ps1 -SubscriptionId "sub" -ResourceGroupName "rg" -VMName "vm" -WhatIf

Script parameters

Parameter Required Description Default
SubscriptionId Yes Azure subscription ID -
ResourceGroupName Yes Resource group containing the VM -
VMName Yes Virtual machine name -
RestorePointCollectionName No Restore point collection (auto-discovered if omitted) Auto-detected
RestorePointName No Specific restore point to use Latest restore point
RestoredDiskSuffix No Suffix appended to restored disk names -restored
KeepOriginalDisks No Keep original disks after restore $false
WhatIf No Show what would happen without making changes -

Verify recovery succeeded

  1. VM is running: Get-AzVM -ResourceGroupName "rg" -Name "vm" -Status shows VM running.
  2. Connectivity: RDP (Windows) or SSH (Linux) into the VM.
  3. Application and data integrity: services, databases, and data-disk contents are intact.
  4. Disk configuration: OS and data disks are attached with expected LUNs/caching.
  5. Clean up original disks if you did not use -KeepOriginalDisks.

Notes: expect ~5–15 minutes of downtime during restore. The script handles availability zones automatically. Always test restore in a non-production environment first, and consider taking snapshots of current disks before restoring as an extra safety net.

Cost

Pay only for the incremental snapshot storage consumed by restore points, ~$0.05/GB per month (about $35/month for a typical VM with 700 GB of storage). There is no vault, no license, and no separate protection SKU. Cost scales with change rate and disk size, not VM count.

Comparison: Basic VM Protection vs Azure Backup

Feature Basic VM Protection Azure Backup
Use case Data resiliency Data + infra + cyber resiliency
Pricing Snapshot (~$0.05/GB/mo), ~40% cheaper than enterprise-grade backup Vault license + vault storage + snapshot
RPO 24 hours 4–24 hours, multiple backups per day
Retention 3 days 7 days to 99 years
Consistency Crash-consistent only App- and crash-consistent
Restore granularity Disk-level restore File / disk / VM-level restore
Supported resources VM only VM, AKS, File storage, databases
Target workloads Basic backup with minimal cost and complexity Enterprise-grade backup features

Upgrade from Basic VM Protection to Azure Backup

As protection requirements grow, upgrade to Azure Backup without reconfiguring workloads:

  • Enhanced recovery: multiple recovery points per day for lower RPO, longer retention and lifecycle management, and application-consistent backups.
  • Enterprise security & compliance: Microsoft Defender for Cloud integration, malware/ransomware detection, cross-region restore for DR, and compliance-aligned governance.
  • Operational flexibility: multiple resource types (VMs, databases, file storage, Kubernetes), granular file/app restore, and policy-driven backup at scale.

Feedback

Please complete the feedback form as you try the preview. Your feedback directly shapes the product, including any changes to fixed RPO/retention.

Contributing

Issues and pull requests are welcome for the scripts and documentation. Please open an issue describing the scenario before submitting large changes.

License

Licensed under the MIT License.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship.

About

Documentation for private preview of Azure Basic VM Protection.

Resources

Readme
MIT license

Code of conduct

Code of conduct

Security policy

Security policy
Activity
Custom properties

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Used by

Contributors

Languages