The booking database of Nordlicht Reisen GmbH, a fictional travel agency, lives on a machine. A faulty update, a deleted disk, or malware, and yesterday's state is gone. Azure Backup backs up machines and data and restores them. The exam calls this: create a Recovery Services vault and a Backup vault, create and configure a backup policy, perform backup and restore, configure and interpret reports and alerts for backups.
Prior knowledge: What Azure Backup is and what it is for is explained in "AZ-900 compact". Virtual machines and disks are covered in lessons 3.3 and 3.4, alerts and action groups in lesson 5.3, Log Analytics in lesson 5.2. This lesson covers how you back up and restore.
Two kinds of vaults
A vault is the Azure resource that holds backup data and policies.
| Recovery Services vault | Backup vault | |
|---|---|---|
| For | Azure VMs, Azure file shares, SQL databases in VMs, on-premises sources through the MARS agent, MABS, or DPM | newer workloads: Azure Blob, Azure Database for PostgreSQL, Azure disks, and more |
| Typical case | back up machines | back up blobs and newer services |
| Reports and alerts | yes, with Log Analytics | yes, with Log Analytics (the schema differs slightly) |
Rule of thumb for the exam: machines and file shares belong in the Recovery Services vault. Both vaults offer role-based access control (Azure Backup ships three built-in roles for recovery points, including Backup Reader) and isolate the backed-up data from the source.
The vault lives in one region; you back up a machine into a vault in the same region. The vault is the place where you later see policies, items, and jobs.
Portal: Recovery Services vaults → Create (subscription, resource group, name, region) or Backup vaults → Create. Azure CLI:
az backup vault create --resource-group <gruppe> --name <tresor> --location germanywestcentral
This creates a Recovery Services vault. For the Backup vault, this course uses the portal.