-
- Veeam Software
- Posts: 165
- Liked: 16 times
- Joined: Jun 13, 2016 11:51 pm
- Full Name: Rob Johnston
- Contact:
Immutability support for Azure Blob
Hi guys,
I am really desperate for any up to date information on Azure Blob immutability support.
I know that we don't support Blob as they are yet to support Immutability at an "Object Level" however I haven't asked for a few months around this so hopefully there is some more news. Basically my patch (ANZ Federal) has an extremely large MS Footprint requirement, and many up to approx 80% have absolutely no AWS workloads and are standardising on MS for Azure, Azure Storage Accounts, O365, Dynamics 365, SQL MI etc, as a part of their MS Licensing VSA, which is really great for us, (Except for Dynamics and SQL MI) that is.
The big problem is that every single one of them has to move to Immutable/WORM/Offline based Backups for 3 Months as a part of the Federal Government ASD Essential 8. So the only option here for them is:
- Tape (However Everyone here is really trying to get away from tape)
- Cloud/Object (However Must be ASD IRAP Assessed and certified to protected on Prem in Australia with Data Sovereignty certification) AWS S3 (Object Lock) is the only supported Cloud they can use that supports our Immutability integration.
-On Prem (Currently Cloudian is the only On Prem option this far that supports Object Lock API's but its not currently in use in Govt in ANZ which will make it hard)
So It will be a huge thing for us locally to push for MS to get Immutability support with Veeam and Azure Blob for both VBR & O365. @Mike Resseler Do you know if there is at least something on the long term roadmap, even if its 12 months away? I have a meeting in the day or so with a customer (300 Sockets) who is all in with Azure, and needs immutable backups as a mandatory requirement across all backups, who does not want to buy any more on Prem storage, and I want to give them some ok news, rather than sorry can't help, when other vendors are banging on the door with supported offerings.
Thanks folks,
Rob
I am really desperate for any up to date information on Azure Blob immutability support.
I know that we don't support Blob as they are yet to support Immutability at an "Object Level" however I haven't asked for a few months around this so hopefully there is some more news. Basically my patch (ANZ Federal) has an extremely large MS Footprint requirement, and many up to approx 80% have absolutely no AWS workloads and are standardising on MS for Azure, Azure Storage Accounts, O365, Dynamics 365, SQL MI etc, as a part of their MS Licensing VSA, which is really great for us, (Except for Dynamics and SQL MI) that is.
The big problem is that every single one of them has to move to Immutable/WORM/Offline based Backups for 3 Months as a part of the Federal Government ASD Essential 8. So the only option here for them is:
- Tape (However Everyone here is really trying to get away from tape)
- Cloud/Object (However Must be ASD IRAP Assessed and certified to protected on Prem in Australia with Data Sovereignty certification) AWS S3 (Object Lock) is the only supported Cloud they can use that supports our Immutability integration.
-On Prem (Currently Cloudian is the only On Prem option this far that supports Object Lock API's but its not currently in use in Govt in ANZ which will make it hard)
So It will be a huge thing for us locally to push for MS to get Immutability support with Veeam and Azure Blob for both VBR & O365. @Mike Resseler Do you know if there is at least something on the long term roadmap, even if its 12 months away? I have a meeting in the day or so with a customer (300 Sockets) who is all in with Azure, and needs immutable backups as a mandatory requirement across all backups, who does not want to buy any more on Prem storage, and I want to give them some ok news, rather than sorry can't help, when other vendors are banging on the door with supported offerings.
Thanks folks,
Rob
-
- Product Manager
- Posts: 14844
- Liked: 3086 times
- Joined: Sep 01, 2014 11:46 am
- Full Name: Hannes Kasparick
- Location: Austria
- Contact:
Re: Immutibility support for Azure Blob
Hi Rob,
my answer will probably not make you happy... I assume that you read the weekly forum digest from today with some explanation.
Can you play it the other way round: will Microsoft offer WORM functionality based on objects?
From your options above: would a VTL in Azure meet the requirements?
Best regards,
Hannes
my answer will probably not make you happy... I assume that you read the weekly forum digest from today with some explanation.
Please check out the list... Cloudian is not the only on-prem storage with object lock supportCurrently Cloudian is the only On Prem option this far that supports Object Lock API's
Can you play it the other way round: will Microsoft offer WORM functionality based on objects?
From your options above: would a VTL in Azure meet the requirements?
even if it was planned for "long distant future", plans can change. That's why we do not communicate that far away future anymore. https://team.veeam.com/apps/news/Pages/ ... admap.aspxsomething on the long term roadmap, even if its 12 months away
Best regards,
Hannes
-
- VP, Product Management
- Posts: 7081
- Liked: 1511 times
- Joined: May 04, 2011 8:36 am
- Full Name: Andreas Neufert
- Location: Germany
- Contact:
Re: Immutibility support for Azure Blob
Please reach out to the Azure Team directly and let them know your situation.
We can not comment on the Microsoft roadmap and timing. Microsoft has as well an idea how they can help you in your situation.
For the more official solutions. A VTL with WORM support that works with BLOB storage based object lock would I think fit the need until Microsoft added the functionallity.
We can not comment on the Microsoft roadmap and timing. Microsoft has as well an idea how they can help you in your situation.
For the more official solutions. A VTL with WORM support that works with BLOB storage based object lock would I think fit the need until Microsoft added the functionallity.
-
- Chief Product Officer
- Posts: 31814
- Liked: 7302 times
- Joined: Jan 01, 2006 1:01 am
- Location: Baar, Switzerland
- Contact:
Re: Immutibility support for Azure Blob
When we met with Azure Storage leadership in Prague half a year ago, it sounded like this feature was a priority for them. At least they clearly understood that without this feature, the moment v10 is out, they will start losing their customers to Amazon.robjohnston wrote: ↑Mar 16, 2020 5:28 amDo you know if there is at least something on the long term roadmap, even if its 12 months away?
-
- Veeam Software
- Posts: 165
- Liked: 16 times
- Joined: Jun 13, 2016 11:51 pm
- Full Name: Rob Johnston
- Contact:
Re: Immutibility support for Azure Blob
Andreas, do you or anyone have any suggustions on supported solutions that is Enterprise Ready? Customer we need to Advise on is around 400 Sockets and has a lot of Data.Andreas Neufert wrote: ↑Mar 16, 2020 9:50 am Please reach out to the Azure Team directly and let them know your situation.
We can not comment on the Microsoft roadmap and timing. Microsoft has as well an idea how they can help you in your situation.
For the more official solutions. A VTL with WORM support that works with BLOB storage based object lock would I think fit the need until Microsoft added the functionallity.
Thanks mate,
Rob
-
- Product Manager
- Posts: 14844
- Liked: 3086 times
- Joined: Sep 01, 2014 11:46 am
- Full Name: Hannes Kasparick
- Location: Austria
- Contact:
Re: Immutibility support for Azure Blob
if I google for "azure vtl" then I find Veeam + Starwind (it seems Azure does not have a "native" VTL like AWS). I would talk to Starwind as a first step and task them for help with sizing etc.
-
- Veeam Software
- Posts: 165
- Liked: 16 times
- Joined: Jun 13, 2016 11:51 pm
- Full Name: Rob Johnston
- Contact:
Re: Immutibility support for Azure Blob
Thanks Hannes. But I was hoping for something a little more tested and referenceable if possible I found the same thing with Starwind in a google search.
-
- Product Manager
- Posts: 14844
- Liked: 3086 times
- Joined: Sep 01, 2014 11:46 am
- Full Name: Hannes Kasparick
- Location: Austria
- Contact:
Re: Immutibility support for Azure Blob
I don't believe that anyone is using VTLs at large scale with Veeam in the cloud, because our object storage implementation makes just so much more sense. It's probably even harder to find a reference for a "stupid idea"
But it's not about us. It's about Starwind handling a lot of data. For us it's "just a tape library".
As I said earlier: I would play it via Microsoft. The customer should talk to them about their future plans about object locks instead of bucket locks.
But it's not about us. It's about Starwind handling a lot of data. For us it's "just a tape library".
As I said earlier: I would play it via Microsoft. The customer should talk to them about their future plans about object locks instead of bucket locks.
-
- Chief Product Officer
- Posts: 31814
- Liked: 7302 times
- Joined: Jan 01, 2006 1:01 am
- Location: Baar, Switzerland
- Contact:
Re: Immutibility support for Azure Blob
Exactly. Customers should push Microsoft to deliver this feature, threatening to switch to Amazon otherwise!
-
- Veeam Software
- Posts: 165
- Liked: 16 times
- Joined: Jun 13, 2016 11:51 pm
- Full Name: Rob Johnston
- Contact:
Re: Immutibility support for Azure Blob
Thanks guys,
The problem is that other Backup vendors support Azure immutable storage, and for them it's a lot simpler and easier to change a backup solution to meet their compliance check box that it needs to comply with, than it is to create a new Government procurement contract with AWS, setup Direct connect, retrain all of their staff on AWS. Most simply have no procurement contract whatsoever with AWS.
It's simply not going to happen in Federal here (Aka Customers will jump to AWS) and unfortunately MS Know it. They are too intrenched into a Microsoft VSA. Is there no way we can make this work? we did it for NDMP. lol
The problem is that other Backup vendors support Azure immutable storage, and for them it's a lot simpler and easier to change a backup solution to meet their compliance check box that it needs to comply with, than it is to create a new Government procurement contract with AWS, setup Direct connect, retrain all of their staff on AWS. Most simply have no procurement contract whatsoever with AWS.
It's simply not going to happen in Federal here (Aka Customers will jump to AWS) and unfortunately MS Know it. They are too intrenched into a Microsoft VSA. Is there no way we can make this work? we did it for NDMP. lol
-
- Product Manager
- Posts: 14844
- Liked: 3086 times
- Joined: Sep 01, 2014 11:46 am
- Full Name: Hannes Kasparick
- Location: Austria
- Contact:
Re: Immutibility support for Azure Blob
what kind of answer do you expect? we mentioned the workarounds and also gave the answer we will support it if Microsoft supports object lock.Is there no way we can make this work?
If federal does not care about costs, well, that's a special situation. most customers change their mind by asking them "do you want to pay 10M or 3M?" for example.
remember the time when we could not backup physical machines and there was no workaround?
-
- Chief Product Officer
- Posts: 31814
- Liked: 7302 times
- Joined: Jan 01, 2006 1:01 am
- Location: Baar, Switzerland
- Contact:
Re: Immutibility support for Azure Blob
As it was already suggested above, VTL to Azure blob storage container with immutability enabled checks the box, and is as effective as those vendors who support Azure immutability natively.robjohnston wrote: ↑Apr 01, 2020 2:21 amto meet their compliance check box that it needs to comply with
-
- Veeam Software
- Posts: 165
- Liked: 16 times
- Joined: Jun 13, 2016 11:51 pm
- Full Name: Rob Johnston
- Contact:
Re: Immutibility support for Azure Blob
Thanks Anton, does anyone have an example or an idea of one that may be ok? Please be mindful They have a huge amount of StoreOnce 5500's onsite with Catalyst stores as their Primary and Secondary Veeam Repo's. (Wasn't my design but is what I am working with)
In all of the reading I have done, as I have never deployed one, most VTL's including Starwind seem to require ISCSI storage available on Premise to use as a Target before it pushes out to Blob, customer doesn't want to purchase any more storage on prem and the StoreOnce's won't be a good candidate to land a VTL Disk on to it.
Rob
In all of the reading I have done, as I have never deployed one, most VTL's including Starwind seem to require ISCSI storage available on Premise to use as a Target before it pushes out to Blob, customer doesn't want to purchase any more storage on prem and the StoreOnce's won't be a good candidate to land a VTL Disk on to it.
Rob
-
- Product Manager
- Posts: 14844
- Liked: 3086 times
- Joined: Sep 01, 2014 11:46 am
- Full Name: Hannes Kasparick
- Location: Austria
- Contact:
Re: Immutibility support for Azure Blob
I have seen a couple of iSCSI VTLs in our labs and I have never heard of that requirement. Do you have a documentation or something on that? I only know the way that the VTL is connected via iSCSI instead of Fibre Channel / SASmost VTL's including Starwind seem to require ISCSI storage available on Premise to use as a Target before it pushes out to Blob,
-
- Veeam Software
- Posts: 2097
- Liked: 310 times
- Joined: Nov 17, 2015 2:38 am
- Full Name: Joe Marton
- Location: Chicago, IL
- Contact:
Re: Immutibility support for Azure Blob
I believe Starwind's solution requires local storage to be used as a cache before sending data to "tapes" (aka object storage), but I don't think there's an iSCSI requirement. You just need some space on C: or D: or wherever you are running it since it's a Windows-based solution. At least that's what I recall from my little bit of exposure to it.
Joe
Joe
-
- VP, Product Management
- Posts: 7081
- Liked: 1511 times
- Joined: May 04, 2011 8:36 am
- Full Name: Andreas Neufert
- Location: Germany
- Contact:
Re: Immutibility support for Azure Blob
The connection to the Veeam Tape server is done by iSCSI.
-
- Veeam Software
- Posts: 2097
- Liked: 310 times
- Joined: Nov 17, 2015 2:38 am
- Full Name: Joe Marton
- Location: Chicago, IL
- Contact:
Re: Immutibility support for Azure Blob
Yes, the tape connection is iSCSI. But not the local disk cache storage.
Joe
Joe
-
- Influencer
- Posts: 19
- Liked: 2 times
- Joined: Apr 25, 2018 8:30 pm
- Full Name: Ryan Deemer
- Contact:
Re: Immutibility support for Azure Blob
Reviving this thread. Is there any update on immutability for Azure Blob?
-
- Product Manager
- Posts: 14844
- Liked: 3086 times
- Joined: Sep 01, 2014 11:46 am
- Full Name: Hannes Kasparick
- Location: Austria
- Contact:
Re: Immutibility support for Azure Blob
Microsoft did not release object lock yet. So no change for today.
-
- Chief Product Officer
- Posts: 31814
- Liked: 7302 times
- Joined: Jan 01, 2006 1:01 am
- Location: Baar, Switzerland
- Contact:
Re: Immutibility support for Azure Blob
No changes.
-
- Chief Product Officer
- Posts: 31814
- Liked: 7302 times
- Joined: Jan 01, 2006 1:01 am
- Location: Baar, Switzerland
- Contact:
Re: Immutability support for Azure Blob
And I'm hearing from @johan.h they are really struggling to deliver it, so much it leaves us no time to include support even in V12!
-
- Veeam Software
- Posts: 723
- Liked: 185 times
- Joined: Jun 05, 2013 9:45 am
- Full Name: Johan Huttenga
- Contact:
Re: Immutability support for Azure Blob
Yes, this has slipped quite a few times now. This functionality is tied to the versioning system in Azure Storage and has taken longer than expected.
Microsoft's initial intent was to GA in line with Ignite 2021. We don't even have a preview yet. At this point we're being given vague dates around when that would be, and it appears it may be far enough in the future that it is very unlikely to fit in the schedule for v12. They have escalated this internally. Even if we get access our team will of course need to test, build and validate everything.
Microsoft's initial intent was to GA in line with Ignite 2021. We don't even have a preview yet. At this point we're being given vague dates around when that would be, and it appears it may be far enough in the future that it is very unlikely to fit in the schedule for v12. They have escalated this internally. Even if we get access our team will of course need to test, build and validate everything.
-
- Enthusiast
- Posts: 44
- Liked: 1 time
- Joined: Sep 09, 2014 1:12 pm
- Full Name: jvl
- Contact:
Re: Immutability support for Azure Blob
Just for your info last update I got from MS is the following (don't know if it's correct since the dates are indeed constantly moving..)
Stage Estimated ETA
Private Preview (Canary and REST support) Mid-April
Private Preview (Pilot+ and .NET support) May 11
Public Preview (France and Canada) July
GA September
Other question don't know If I'm allowed to ask it here but its also related to our roadmap and to protect the storage account BLOBs when offloading data into Azure. Are there any plans to do authentication via Azure AD Managed Service Identities?
The context of this question is the following: this is an Azure service where on-premises VMs can be managed from the Azure portal. A nice feature here is that an Azure Arc enabled server can get an identity in the Azure Active Directory (Azure AD), a "managed identity". This is currently the most secure and accepted way of authentication because there are no credentials that can leak, be rotated, etc. etc.
If the VEEAM software runs on a VM, it could request an MSI token instead of authenticating against the storage account with a SAS token or service principal. Is this on our roadmap?
Stage Estimated ETA
Private Preview (Canary and REST support) Mid-April
Private Preview (Pilot+ and .NET support) May 11
Public Preview (France and Canada) July
GA September
Other question don't know If I'm allowed to ask it here but its also related to our roadmap and to protect the storage account BLOBs when offloading data into Azure. Are there any plans to do authentication via Azure AD Managed Service Identities?
The context of this question is the following: this is an Azure service where on-premises VMs can be managed from the Azure portal. A nice feature here is that an Azure Arc enabled server can get an identity in the Azure Active Directory (Azure AD), a "managed identity". This is currently the most secure and accepted way of authentication because there are no credentials that can leak, be rotated, etc. etc.
If the VEEAM software runs on a VM, it could request an MSI token instead of authenticating against the storage account with a SAS token or service principal. Is this on our roadmap?
-
- Veeam Software
- Posts: 303
- Liked: 44 times
- Joined: May 15, 2013 10:40 am
- Full Name: Mariusz Rybusiński
- Location: Poland
- Contact:
Re: Immutability support for Azure Blob
From my source preview will be in Q3, GA in Q4.Just for your info last update I got from MS is the following (don't know if it's correct since the dates are indeed constantly moving..)
Stage Estimated ETA
Private Preview (Canary and REST support) Mid-April
Private Preview (Pilot+ and .NET support) May 11
Public Preview (France and Canada) July
GA September
-
- Chief Product Officer
- Posts: 31814
- Liked: 7302 times
- Joined: Jan 01, 2006 1:01 am
- Location: Baar, Switzerland
- Contact:
Re: Immutability support for Azure Blob
@jvl as always we can't comment on the roadmap. Also, please don't derail the discussion with completely unrelated queries. Just create a new topic (if you can't find an existing discussion), it costs literally nothing to keep this forum tidy and easily consumable. Thanks!
Who is online
Users browsing this forum: Google [Bot] and 11 guests