Azure Backup policies as IaC fails to deploy when associated VMs are missing/failed to perform a backup

Question

Azure Backup policies as IaC fails to deploy when associated VMs are missing/failed to perform a backup

Lasse Hastrup 0

Hello,

We're having issues deploying RSV Backup policies using Infrastructure as Code, when either of these scenarios are happening:

VM that is associated with the backup no longer exist in Azure (Deleted, but forgot to stop the backup)
SQL server failed to perform a backup (UserErrorTargetDataSourceCannotBeOpened)

As i'm in a platform team, where we provide the basic needs to our Landing Zone owners, the Recovery Service Vault with the Backup policies are a central part of our solution, and is deployed from our central pipelines.

However we don't want to receive failed deployments because of the two bullets mentioned before; this is not relevant to the central solution of RSV and their backup policies.

How do we tackle this?

Thanks,

1 answer

Your answer

Answer 1

Stanislav Zhelyazkov 27,321 MVP

Hi,

I would suggest to delete (stop) the backup items associated with those deleted resources. When you put resources under Azure Backup backup items are created for them. When you delete backup items you have the option to retain or delete backup data. Note that if soft-delete is enabled and depending on the workload type you might not be able to delete the data and you will need to retain it only. Here is how it is done for Azure VMs but the process is similar for other types of workloads.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Lasse Hastrup 0 Reputation points

2025-04-15T08:59:42.94+00:00

Hi @Stanislav Zhelyazkov ,

Appreciate the fast reply.

I'm familiar with the 'workaround' in terms of stopping the backup for the given VM. But this will require a manual operation from our Platform team, which we don't want.

Currently i have a pipeline running that is detecting 'orphaned' VMs from existing backup policies, then creating a POST to stop backup. But I was hoping this responsibility could be handled by the Recovery Services team, and not by us, as there should be a clear segmentation between Platform resources and LandingZones resources in terms of CAF and Azure LandingZone frameworks.

Br,
Stanislav Zhelyazkov 27,321 Reputation points MVP

2025-04-15T09:07:14.33+00:00

IaC cannot cover all your scenarios as there will always be some operations that require operations actions outside of your IaC. You could have build your IaC in a way that when the actual resource is deleted that also deletes the backup item. I do not know the details of your IaC deployments so I can suggest you something general as answer. Additionally keep in mind that backup is not only regular service. It is also meant to be a security service in case of malicious actions to be able to perform restores without the backup being affected by those restore points.
Naveena Patlolla 1,720 Reputation points Microsoft External Staff

2025-04-16T09:39:25.77+00:00

Hi Lasse Hastrup

Just checking in to see if the above answer provided by @Stanislav Zhelyazkov helped.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know
Naveena Patlolla 1,720 Reputation points Microsoft External Staff

2025-04-17T09:03:54.9866667+00:00

Hi Lasse Hastrup

We haven't heard back from you. Please reply if you have any questions in this matter and we are here to help you

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know

Share via

Azure Backup policies as IaC fails to deploy when associated VMs are missing/failed to perform a backup

1 answer

Your answer