backup of Azure Storage accounts

[sandsturm]

Hi all

I need to create backups of different Azure Storage Accounts, but could not find an option in VBAZ to do that. How can I achieve a backup of a storage account with Veeam?

many thanks and regards,
sandsturm

[hani92]

Hi,

What is it that you are trying to backup in Azure Storage Accounts? Currently VBAz can backup Azure Files and send backups to Azure Blob storage.

[sandsturm]

The point is, that I do not have a clue about all the contents in the different storage accounts. Usually we have different containers within a storageaccount with data of an application. I just need an option to backup these things. A storage account provides the option to store data in containers (blobs), File shares (as you said), queues or tables. I just need the option to have a generic option to backup data of these storage accounts, doesn't matter whats in it.

[sandsturm]

it looks like Veeam VBR version 12.1 will bring the capability to backup data from Azure storage accounts at least for blob storage accounts and that should solve my problem.

[Mildur]

Hi Sandsturm

Correct. You will be able to protect the content of an Azure Blob storage. Stay tuned for a release till end of this year.

Best,
Fabian

[sandsturm]

I just read here: https://helpcenter.veeam.com/docs/backu ... ob-storage that a backup of storage accounts encrypted with a customer managed key cannot be backed up?
My question is then: How does veeam create backups of "standard" Storage accounts? Every storage account is encrypted per default. The difference is only the customer managed key, which is used or even not used. Is the process different and is there no way to create backups of storage accounts encrypted with a customer managed key?

thx,
sandsturm

[Dima P.]

No difference, both are supported and we work correctly with Microsoft-managed and customer-managed encryption keys. The note in the help center was aimed to mention that customer-provided encryption keys for specific blobs are not supported. I've asked TW to correct the statement.

[sandsturm]

No difference, both are supported and we work correctly ...

That is great news!

thx,
sandsturm

[gcg]

Currently VBAz can backup Azure Files and send backups to Azure Blob storage.

I don't think you can take an Azure Files backup and send to Azure Blob storage. Azure Files backups are just snapshot management front-end to Azure snaps. VBAZ doesn't do any sort of copying that to immutable or anything else.

If you have VBR, though, then you can now with 12.1.2.172 backup "object storage" as "unstructured backups" so you can then get that actually copied into immutable backups and archival spaces, but VBAZ doesn't do that natively (at least not that I could find digging through all of the documentation on VBAZ and Azure Files backups.

[Dima P.]

Hello gcg,

You can mount Azure Files as NFS or SMB and backup such data via Veeam B&R Unstructured Data backup with all the capabilities preserved. Thank you!

[albertwt]

backup such data via Veeam B&R Unstructured Data backup

@Dima, does it mean, the backup can be done using the VBR without the Veeam Backup for Microsoft Azure ?

[Dima P.]

Hello albertwt,

Correct, object storage backup is a feature of Veeam B&R, so in order to backup data under your Azure storage account you will need to use Veeam B&R. Thank you!

[albertwt]

Thank you Dima for the confirmation.

[sandsturm]

Hi all

I configured the backup of Azure storage accounts and I am able to backup such storage accounts, as long as I use shared key credentials to access the storage account. As soon as I change this to use Entra ID instead of shared keys, the backup does not work any more. I had a veeam case to this topic (Case #07428436), but were not able to solve the issue. Veeam support said, that they cannot help, because it is something network related in our environment, what is not correct in my opinion. Our VBR server can connect to the internet (and Azure services) only via http proxy, therefore all communication to such services need to traverse the http proxy. Our Azure storage Accounts do not have a public IP address and are reachable via "internal" network (VPN connection from onpremise to Azure). As I said, everything works fine, as long as I use shared keys for the authentication. I'm not sure if veeam tries to access the storage account now as well via http proxy and not via "internal network", as soon as I use Entra ID for the authentication.
- Shared key authentication is not allowed to be compliant with our company internal security guidelines.
- Shared key is also difficult from an operating perspective, because each Storage Account has other shared keys, therefore not a feasible solution, if I want to backup hundreds of Storage accounts.
- we had in the past some cases, where veeam was not able to handle connections via http proxy always well. For some use cases, veeam was not able to use the configured http proxy settings, for other use cases, it worked flawless (at the same time). Therefore I'm not sure if the current problem has the same reason....

I really need a solution to be able to backup a lot of Azure storage accounts. Is maybe someone out there, which has the same problem, but already solved?

thx,
sandsturm