Lab: Recovery Services vault policy and reports

Outcome

Create a Recovery Services vault for a supported workload, choose its protection settings before use, assign and change a backup policy, then inspect job/report data and an Azure Monitor-based backup alert.

Do

1. Choose a workload supported by a Recovery Services vault and a disposable region/resource group. Create the vault, record redundancy and security/soft-delete settings, and explain why vault type cannot be substituted solely by name.
2. Create or copy a training backup policy with an explicit schedule and retention decision. Assign it to a disposable protected item, run an on-demand backup, then change the policy only after recording which future recovery points/retention are affected.
3. Configure vault diagnostic settings to a Log Analytics workspace. Inspect Backup Jobs, Backup Alerts, and Backup Reports after data is available. Configure an Azure Monitor action group/rule for a safe failed-job or security scenario; do not use classic backup alerts, which retired on 2026-03-31.

Verify

Capture vault type/redundancy/security settings, policy schedule/retention and assignment, job state/recovery point, diagnostics destination, report/alert evidence, and notification route. You should now understand: a vault supports specific workloads; policy defines protection cadence and retention; reports summarize evidence while Azure Monitor routes actionable alerts.

Break and fix

1. Attempt to protect an unsupported workload or select the wrong vault type. Diagnose support before creating a second vault.
2. Assign a training policy with an unacceptable retention/schedule. Correct the policy deliberately and record its effect rather than deleting recovery data.
3. Query a report before diagnostics data arrives. Diagnose workspace linkage and initial ingestion delay, then inspect jobs/alerts directly in the vault.

Scenario practice

1. Configure: Select vault type, redundancy/security, policy cadence/retention, report destination, and alert route for a VM workload.
2. Diagnose: A backup job failed but no notification arrived. Inspect job state, Azure Monitor alert, action group, processing rule, and vault diagnostics.
3. Distinguish: Contrast Recovery Services vault and Backup vault, a backup policy and recovery point, a report and an alert.

Clean up

Stop protection according to the chosen data-retention intent, remove protected items only after confirming recovery points may be deleted, then remove policy, diagnostics, alerts, workspace, vault, and training group.

Sources and re-audit

• Azure Backup monitoring and alerts, checked 2026-08-22.
• Configure Azure Backup reports, checked 2026-08-22.
• Manage Azure Monitor alerts for Backup, checked 2026-08-22.

Re-audit when supported workloads, vault protection, reports, or alerting change.

Related

recovery-services-vault · backup-vault · azure-backup-policy · backup-reports · All labs