Immutability support for Azure Blob

[robjohnston]

Hi guys,

I am really desperate for any up to date information on Azure Blob immutability support.
I know that we don't support Blob as they are yet to support Immutability at an "Object Level" however I haven't asked for a few months around this so hopefully there is some more news. Basically my patch (ANZ Federal) has an extremely large MS Footprint requirement, and many up to approx 80% have absolutely no AWS workloads and are standardising on MS for Azure, Azure Storage Accounts, O365, Dynamics 365, SQL MI etc, as a part of their MS Licensing VSA, which is really great for us, (Except for Dynamics and SQL MI) that is.

The big problem is that every single one of them has to move to Immutable/WORM/Offline based Backups for 3 Months as a part of the Federal Government ASD Essential 8. So the only option here for them is:
- Tape (However Everyone here is really trying to get away from tape)
- Cloud/Object (However Must be ASD IRAP Assessed and certified to protected on Prem in Australia with Data Sovereignty certification) AWS S3 (Object Lock) is the only supported Cloud they can use that supports our Immutability integration.
-On Prem (Currently Cloudian is the only On Prem option this far that supports Object Lock API's but its not currently in use in Govt in ANZ which will make it hard)

So It will be a huge thing for us locally to push for MS to get Immutability support with Veeam and Azure Blob for both VBR & O365. @Mike Resseler Do you know if there is at least something on the long term roadmap, even if its 12 months away? I have a meeting in the day or so with a customer (300 Sockets) who is all in with Azure, and needs immutable backups as a mandatory requirement across all backups, who does not want to buy any more on Prem storage, and I want to give them some ok news, rather than sorry can't help, when other vendors are banging on the door with supported offerings.

Thanks folks,
Rob

[HannesK]

Hi Rob,
my answer will probably not make you happy... I assume that you read the weekly forum digest from today with some explanation.

Currently Cloudian is the only On Prem option this far that supports Object Lock API's

Please check out the list... Cloudian is not the only on-prem storage with object lock support

Can you play it the other way round: will Microsoft offer WORM functionality based on objects?

From your options above: would a VTL in Azure meet the requirements?

something on the long term roadmap, even if its 12 months away

even if it was planned for "long distant future", plans can change. That's why we do not communicate that far away future anymore. https://team.veeam.com/apps/news/Pages/ ... admap.aspx

Best regards,
Hannes

[Andreas Neufert]

Please reach out to the Azure Team directly and let them know your situation.
We can not comment on the Microsoft roadmap and timing. Microsoft has as well an idea how they can help you in your situation.

For the more official solutions. A VTL with WORM support that works with BLOB storage based object lock would I think fit the need until Microsoft added the functionallity.

[Gostev]

Do you know if there is at least something on the long term roadmap, even if its 12 months away?

When we met with Azure Storage leadership in Prague half a year ago, it sounded like this feature was a priority for them. At least they clearly understood that without this feature, the moment v10 is out, they will start losing their customers to Amazon.

[robjohnston]

Please reach out to the Azure Team directly and let them know your situation.
We can not comment on the Microsoft roadmap and timing. Microsoft has as well an idea how they can help you in your situation.

For the more official solutions. A VTL with WORM support that works with BLOB storage based object lock would I think fit the need until Microsoft added the functionallity.

Andreas, do you or anyone have any suggustions on supported solutions that is Enterprise Ready? Customer we need to Advise on is around 400 Sockets and has a lot of Data.

Thanks mate,

Rob

[HannesK]

if I google for "azure vtl" then I find Veeam + Starwind (it seems Azure does not have a "native" VTL like AWS). I would talk to Starwind as a first step and task them for help with sizing etc.

[robjohnston]

Thanks Hannes. But I was hoping for something a little more tested and referenceable if possible I found the same thing with Starwind in a google search.

[HannesK]

I don't believe that anyone is using VTLs at large scale with Veeam in the cloud, because our object storage implementation makes just so much more sense. It's probably even harder to find a reference for a "stupid idea"

But it's not about us. It's about Starwind handling a lot of data. For us it's "just a tape library".

As I said earlier: I would play it via Microsoft. The customer should talk to them about their future plans about object locks instead of bucket locks.

[Gostev]

Exactly. Customers should push Microsoft to deliver this feature, threatening to switch to Amazon otherwise!

[robjohnston]

Thanks guys,

The problem is that other Backup vendors support Azure immutable storage, and for them it's a lot simpler and easier to change a backup solution to meet their compliance check box that it needs to comply with, than it is to create a new Government procurement contract with AWS, setup Direct connect, retrain all of their staff on AWS. Most simply have no procurement contract whatsoever with AWS.

It's simply not going to happen in Federal here (Aka Customers will jump to AWS) and unfortunately MS Know it. They are too intrenched into a Microsoft VSA. Is there no way we can make this work? we did it for NDMP. lol

[HannesK]

Is there no way we can make this work?

what kind of answer do you expect? we mentioned the workarounds and also gave the answer we will support it if Microsoft supports object lock.

If federal does not care about costs, well, that's a special situation. most customers change their mind by asking them "do you want to pay 10M or 3M?" for example.

remember the time when we could not backup physical machines and there was no workaround?

[Gostev]

to meet their compliance check box that it needs to comply with

As it was already suggested above, VTL to Azure blob storage container with immutability enabled checks the box, and is as effective as those vendors who support Azure immutability natively.

[robjohnston]

Thanks Anton, does anyone have an example or an idea of one that may be ok? Please be mindful They have a huge amount of StoreOnce 5500's onsite with Catalyst stores as their Primary and Secondary Veeam Repo's. (Wasn't my design but is what I am working with)

In all of the reading I have done, as I have never deployed one, most VTL's including Starwind seem to require ISCSI storage available on Premise to use as a Target before it pushes out to Blob, customer doesn't want to purchase any more storage on prem and the StoreOnce's won't be a good candidate to land a VTL Disk on to it.

Rob

[HannesK]

most VTL's including Starwind seem to require ISCSI storage available on Premise to use as a Target before it pushes out to Blob,

I have seen a couple of iSCSI VTLs in our labs and I have never heard of that requirement. Do you have a documentation or something on that? I only know the way that the VTL is connected via iSCSI instead of Fibre Channel / SAS

[jmmarton]

I believe Starwind's solution requires local storage to be used as a cache before sending data to "tapes" (aka object storage), but I don't think there's an iSCSI requirement. You just need some space on C: or D: or wherever you are running it since it's a Windows-based solution. At least that's what I recall from my little bit of exposure to it.

Joe

[Andreas Neufert]

The connection to the Veeam Tape server is done by iSCSI.

[jmmarton]

Yes, the tape connection is iSCSI. But not the local disk cache storage.

Joe

[R.Deemer]

Reviving this thread. Is there any update on immutability for Azure Blob?

[HannesK]

Microsoft did not release object lock yet. So no change for today.

[Gostev]

No changes.

[Gostev]

And I'm hearing from @johan.h they are really struggling to deliver it, so much it leaves us no time to include support even in V12!

[johan.h]

Yes, this has slipped quite a few times now. This functionality is tied to the versioning system in Azure Storage and has taken longer than expected.

Microsoft's initial intent was to GA in line with Ignite 2021. We don't even have a preview yet. At this point we're being given vague dates around when that would be, and it appears it may be far enough in the future that it is very unlikely to fit in the schedule for v12. They have escalated this internally. Even if we get access our team will of course need to test, build and validate everything.

[jvl]

Just for your info last update I got from MS is the following (don't know if it's correct since the dates are indeed constantly moving..)
Stage Estimated ETA
Private Preview (Canary and REST support) Mid-April
Private Preview (Pilot+ and .NET support) May 11
Public Preview (France and Canada) July
GA September

Other question don't know If I'm allowed to ask it here but its also related to our roadmap and to protect the storage account BLOBs when offloading data into Azure. Are there any plans to do authentication via Azure AD Managed Service Identities?

The context of this question is the following: this is an Azure service where on-premises VMs can be managed from the Azure portal. A nice feature here is that an Azure Arc enabled server can get an identity in the Azure Active Directory (Azure AD), a "managed identity". This is currently the most secure and accepted way of authentication because there are no credentials that can leak, be rotated, etc. etc.
If the VEEAM software runs on a VM, it could request an MSI token instead of authenticating against the storage account with a SAS token or service principal. Is this on our roadmap?

[mariuszr]

Just for your info last update I got from MS is the following (don't know if it's correct since the dates are indeed constantly moving..)
Stage Estimated ETA
Private Preview (Canary and REST support) Mid-April
Private Preview (Pilot+ and .NET support) May 11
Public Preview (France and Canada) July
GA September

From my source preview will be in Q3, GA in Q4.

[Gostev]

@jvl as always we can't comment on the roadmap. Also, please don't derail the discussion with completely unrelated queries. Just create a new topic (if you can't find an existing discussion), it costs literally nothing to keep this forum tidy and easily consumable. Thanks!