Recovery Services Vault
What it is
A Recovery Services vault is an Azure storage container that holds Azure Backup restore points and Site Recovery replication data for the workloads you protect. It is the central “ark” for both backup and disaster-recovery data.
Why it exists
Backups and replicas must live separate from the production resource so that a failure/accident on the source (deletion, ransomware, region outage) can’t destroy the protection copies. The vault provides a managed, encrypted, access-controlled store with a defined billing model.
Key ideas
- Holds both: Backup (restore points, backup items) and Site Recovery (replicated VMs, replication policies).
- Encryption at rest (platform key or customer-managed keys), soft delete (forgot/recovered-deleted backups), and RBAC control over access.
- Policy (Backup policy) is created/applied from within the vault.
- Vaults are regional — choose the region that balances cost + residency; backup/replication data is stored there.
- View backup items, job state, and run restore/failover from the vault blade.
How it fits (diagram)
Diagrams courtesy of Microsoft Learn / Azure docs: backup/backup-azure-recovery-services-vault-overview
Exam notes
- Name the vault-does-both: backup restore points + Site Recovery replication.
- Vault encryption settings are set at creation and apply to stored data; plan CMK if required.
- Soft delete must be considered when removing backups.
- Vault is a resource (RG-scoped, RBAC-controlled) — needed before you can enable backup or replication.
Related
azure-backup · azure-backup-policy · azure-site-recovery · azure-vm · Home