| name | Azure Backup Recovery |
| description | Deep expertise in Azure Backup Recovery operations with deterministic runbooks, fail-fast context validation, and redacted output requirements.
|
| allowed-tools | ["Read","Write","Edit","Glob","Grep","Bash"] |
| triggers | ["azure backup","site recovery","backup health","restore drill","recovery plan"] |
Azure Backup Recovery
Integration Context Contract
| Workflow | tenantId | subscriptionId | environmentCloud | principalType | scopesOrRoles |
|---|
| Azure Backup Recovery operations | required | required | AzureCloud* | service-principal or delegated-user | Backup Reader, Site Recovery Contributor, Reader |
- Use sovereign cloud values from the canonical contract when applicable.
Fail fast before API calls when required context is missing or malformed. Redact tenant, subscription, and object identifiers.
Command Surface
| Command | Purpose |
|---|
backup-recovery-setup | Deterministic workflow for backup recovery setup. |
backup-job-health | Deterministic workflow for backup job health. |
backup-restore-drill | Deterministic workflow for backup restore drill. |
backup-recovery-plan-audit | Deterministic workflow for backup recovery plan audit. |
backup-cross-region-check | Deterministic workflow for backup cross region check. |
Guardrails
- Validate context schema and minimum grants before any API call.
- Run read-only discovery first whenever possible.
- Require explicit confirmation for destructive actions.
- Re-query and verify post-action state.
- Return structured, redacted output.
Azure CLI Reference
Recovery Services Vault
az backup vault create --name <vault-name> --resource-group <rg> --location <region>
az backup vault show --name <vault> --resource-group <rg>
az backup vault list --resource-group <rg> --output table
az backup vault delete --name <vault> --resource-group <rg> --yes --force
az backup vault backup-properties set --name <vault> --resource-group <rg> --backup-storage-redundancy GeoRedundant
az backup vault backup-properties show --name <vault> --resource-group <rg>
Backup Policies
az backup policy create --vault-name <vault> --resource-group <rg> --name <policy-name> --policy @vm-backup-policy.json --backup-management-type AzureIaasVM
az backup policy list --vault-name <vault> --resource-group <rg> --output table
az backup policy list --vault-name <vault> --resource-group <rg> --backup-management-type AzureIaasVM --output table
az backup policy show --vault-name <vault> --resource-group <rg> --name <policy-name>
az backup policy set --vault-name <vault> --resource-group <rg> --policy @updated-policy.json --name <policy-name>
az backup policy delete --vault-name <vault> --resource-group <rg> --name <policy-name>
az backup policy get-default-for-vm --vault-name <vault> --resource-group <rg>
VM Backup
az backup protection enable-for-vm --vault-name <vault> --resource-group <rg> --vm <vm-name> --policy-name <policy-name>
az backup protection backup-now --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --backup-management-type AzureIaasVM --retain-until 2026-04-10
az backup item list --vault-name <vault> --resource-group <rg> --output table
az backup item list --vault-name <vault> --resource-group <rg> --backup-management-type AzureIaasVM --output table
az backup item show --vault-name <vault> --resource-group <rg> --container-name <container> --name <vm-name> --backup-management-type AzureIaasVM
az backup protection disable --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --backup-management-type AzureIaasVM
az backup protection disable --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --backup-management-type AzureIaasVM --delete-backup-data true --yes
Backup Jobs
az backup job list --vault-name <vault> --resource-group <rg> --output table
az backup job list --vault-name <vault> --resource-group <rg> --status Failed --output table
az backup job list --vault-name <vault> --resource-group <rg> --start-date 2026-03-01 --end-date 2026-03-10 --output table
az backup job show --vault-name <vault> --resource-group <rg> --name <job-id>
az backup job wait --vault-name <vault> --resource-group <rg> --name <job-id>
az backup job stop --vault-name <vault> --resource-group <rg> --name <job-id>
Restore Operations
az backup recoverypoint list --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --backup-management-type AzureIaasVM --output table
az backup recoverypoint show --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --backup-management-type AzureIaasVM --name <rp-name>
az backup restore restore-disks --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --rp-name <rp-name> --storage-account <sa-name> --target-resource-group <target-rg>
az backup restore restore-disks --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --rp-name <rp-name> --storage-account <sa-name> --restore-to-staging-storage-account true --target-resource-group <target-rg>
az backup restore files mount-rp --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --rp-name <rp-name>
az backup restore files unmount-rp --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --rp-name <rp-name>
az backup restore restore-disks --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <vm-name> --rp-name <rp-name> --storage-account <sa-name> --target-resource-group <target-rg> --use-secondary-region
Backup Containers
az backup container list --vault-name <vault> --resource-group <rg> --backup-management-type AzureIaasVM --output table
az backup container show --vault-name <vault> --resource-group <rg> --name <container-name> --backup-management-type AzureIaasVM
az backup container register --vault-name <vault> --resource-group <rg> --backup-management-type AzureWorkload --workload-type SAPHANA --resource-id <vm-resource-id>
az backup container unregister --vault-name <vault> --resource-group <rg> --container-name <container> --backup-management-type AzureIaasVM --yes
SQL and File Share Backup
az backup protection enable-for-azurewl --vault-name <vault> --resource-group <rg> --policy-name <policy> --protectable-item-name <db-name> --protectable-item-type SQLDataBase --server-name <server> --workload-type MSSQL
az backup protection enable-for-azurefileshare --vault-name <vault> --resource-group <rg> --policy-name <policy> --storage-account <sa-name> --azure-file-share <share-name>
az backup restore restore-azurefileshare --vault-name <vault> --resource-group <rg> --container-name <container> --item-name <share-name> --rp-name <rp-name> --resolve-conflict Overwrite --restore-mode OriginalLocation
Azure Site Recovery
az backup vault create --name <vault-name> --resource-group <rg> --location <region>
az rest --method PUT \
--url "https://management.azure.com/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.RecoveryServices/vaults/<vault>/replicationFabrics/<fabric>/replicationProtectionContainers/<container>/replicationProtectedItems/<item>?api-version=2023-08-01" \
--body @enable-replication.json
az rest --method GET \
--url "https://management.azure.com/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.RecoveryServices/vaults/<vault>/replicationProtectedItems?api-version=2023-08-01" \
--query "value[].{Name:name, Status:properties.protectionState, Health:properties.replicationHealth}"
az rest --method POST \
--url "https://management.azure.com/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.RecoveryServices/vaults/<vault>/replicationFabrics/<fabric>/replicationProtectionContainers/<container>/replicationProtectedItems/<item>/testFailover?api-version=2023-08-01" \
--body '{"properties":{"failoverDirection":"PrimaryToRecovery","networkId":"<vnet-resource-id>","networkType":"VmNetworkAsInput"}}'
az rest --method POST \
--url "https://management.azure.com/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.RecoveryServices/vaults/<vault>/replicationFabrics/<fabric>/replicationProtectionContainers/<container>/replicationProtectedItems/<item>/testFailoverCleanup?api-version=2023-08-01" \
--body '{"properties":{"comments":"Test complete"}}'
az rest --method POST \
--url "https://management.azure.com/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.RecoveryServices/vaults/<vault>/replicationFabrics/<fabric>/replicationProtectionContainers/<container>/replicationProtectedItems/<item>/plannedFailover?api-version=2023-08-01" \
--body '{"properties":{"failoverDirection":"PrimaryToRecovery"}}'
az rest --method GET \
--url "https://management.azure.com/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.RecoveryServices/vaults/<vault>/replicationRecoveryPlans?api-version=2023-08-01"
az rest --method PUT \
--url "https://management.azure.com/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.RecoveryServices/vaults/<vault>/replicationRecoveryPlans/<plan-name>?api-version=2023-08-01" \
--body @recovery-plan.json
Monitoring and Diagnostics
az backup alert show --vault-name <vault> --resource-group <rg>
az monitor diagnostic-settings create \
--resource "/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.RecoveryServices/vaults/<vault>" \
--name "backup-diag" \
--workspace <workspace-id> \
--logs '[{"categoryGroup":"allLogs","enabled":true}]' \
--metrics '[{"category":"AllMetrics","enabled":true}]'
az backup vault show --name <vault> --resource-group <rg> --query "{Name:name,ProtectedItems:properties.privateEndpointStateForBackup,StorageType:properties.storageModelType}"
Progressive Disclosure - Reference Files