Recovery Services Vault

What it is

A Recovery Services vault is an Azure resource that stores protected copies and recovery information for supported Azure Backup workloads, such as Azure VMs and SQL Server in Azure VMs. It is also a central management point for Azure Backup and Site Recovery jobs, alerts, and reporting.

Why it exists

A production VM is not its own recovery plan. A vault is a managed, access-controlled place for recovery points and policies that remains separate from the workload being protected. It helps the team organize protection, but it does not guarantee an application can meet its recovery objectives unless the team designs and tests those objectives.

Key ideas

• Recovery points and policies: the vault stores recovery points created over time and the policies associated with protected workloads.
• Security: backup data is encrypted with platform-managed keys by default. Customer-managed keys are available for supported designs but must be configured before protecting items in the vault.
• Soft delete: deleted backup data is retained for a protection period; enhanced soft delete can be configured for stronger retention. It is a recovery safeguard, not a replacement for monitoring or access control.
• Redundancy and recovery: choose supported vault storage redundancy and recovery features intentionally. Geographic recovery behavior and feature availability differ by workload and vault configuration.
• Scope: the vault is an Azure resource subject to RBAC. A separate backup policy defines scheduled protection for applicable workloads.

Northwind example

Northwind backs up a production VM to a Recovery Services vault. Maya chooses the policy, Priya watches job results, and the team practices restoring a copy into a safe target. A malicious or mistaken deletion of backup data may be recoverable through soft delete, but a lock on the vault alone does not protect every data-plane operation and does not prove the restored application will work.

How it fits (diagram)

Diagrams courtesy of Microsoft Learn / Azure docs: backup/backup-azure-recovery-services-vault-overview

Exam notes

• Recovery Services vaults and Backup vaults serve different supported workload sets.
• Customer-managed-key encryption must be planned before the first protected item when that requirement applies.
• Soft delete affects how backup removal and recovery behave; include it in decommissioning procedures.

Related

azure-backup · azure-backup-policy · azure-site-recovery · azure-vm · Home

📘 Source: Microsoft Learn — Recovery Services vaults overview