Setup Azure Immutability

[jmorphew2]

I am trying to setup an Azure scale out repository with immutability. I already upgraded to Veeam version 12 and I created a new storage account in Azure. I followed the steps in this KB to create the Azure storage account and container: https://www.veeam.com/kb4416 Then within Veeam I added the new repository and set the container to 'make recent backups immutable for 14 days'. The bottom of the KB states: "Immutability will make your data impossible to delete aside from the termination of the associated Azure subscription" However, when I go into Azure I'm still able to delete the storage account and container. What I am missing? Also, the KB says to 'enable versioning for blobs' and 'keep all versions'. Won't that lead to an Azure storage container that keeps growing indefinitely? How are the old versions removed with these settings?

Thanks for any advice.

[jmorphew2]

Thank you for the reply! I'm trying to understand the benefit of having immutability on the objects but not the container or storage account. It seems like if our Azure account is compromised they will just delete the entire thing. Any clarity is appreciated.

Are there any Veeam articles on setting up Azure Blob Storage Lifecycle Management? Would I set it to match the immutability period used in Veeam?

Thank you again!

[rovshan.pashayev]

Hello,

I apologies that we had to remove the first reply. Please ignore my previous answer about Lifecycle Management. Lifecycle Management with Veeam Backup & Replication is not supported.: https://helpcenter.veeam.com/docs/backu ... ml?ver=120

"Data in object storage bucket/container must be managed solely by Veeam Backup & Replication, including retention and data management. Enabling lifecycle rules is not supported, and may result in backup and restore failures."

Did you run successful immutability backup after adding Azure object repo?
Because if you have container with immutable backup data, you should not be able delete neither container nor account itself. Just connecting the container to Veeam Backup & Replication does not produce immutable data. A backup or backup copy job must run at least once.


Rovshan

[jmorphew2]

No, we do not have any data in the container yet. That would explain why I still have options to delete the container and storage account. I had planned on setting up a secondary job for the new azure storage and slowly moving servers over, but Veeam didn't allow me to reuse the same on prem backup repository with the new scale out repository. So the new plan is to edit the active scale out repository switching to the new immutable capacity tier before a weekend. Since it's a hard cutover I wanted to make sure I had the settings correct before uploading so much data. The 'keep all versions' setting worried me because we had problems with unlimited growth using this setting in the past, that was with Veeam version 11 though.

It sounds like the Veeam KB is correct though, and once I make the switch the Azure delete options will go away, and Veeam will manage the versions so they don't grow out of control?

[rovshan.pashayev]

Hello,

You can only add same type of object storage repositories as performance extents of one scale-out backup repository. See the limitations: https://helpcenter.veeam.com/docs/backu ... ml?ver=120

After the retention and immutability periods are over, VBR will start marking the file versions for deletion according to the retention settings.
Once the immutability lock is released, the file versions will be deleted from the backup repository.

Rovshan

[eichenseherp]

Hi,

we have enabled the Feature "Enable versioning for blobs" in Azure Storage Account.
How long should we keep "delete versions" ? or should we use the given 7 days?

Tanks!

[veremin]

Select the "Keep all versions" option, as described here. Thanks!

[jmorphew2]

I modified the scale out repository and switched to the new immutable capacity tier. Everything went well. Will Veeam age out backup files stored in the old capacity tier? If not, are there steps to manually delete the files?

[veremin]

Am I correct that restore points located on obsolete capacity extent are not currently visible in UI? Thanks!

[jmorphew2]

Yes, that's correct. I no longer see them in the UI. I received this warning when I switched to the immutable repository: "You're about to disable or change your capacity tier to use a different object storage system. All backups offloaded to the currently selected object storage system will become unavailable for restore. Proceed?"

[veremin]

You need to import these backups to the console first and then manually delete them when immutability expires.

Hope this helps.

[jmorphew2]

The old Azure repository that needs to be aged out was not immutable. Can I just remove the old capacity tier from Veeam and delete the storage account from Azure? Or do I still need to import them into Veeam first?

[veremin]

Ah, I misunderstood you - I thought you wanted to preserve these backups for some time.

In your case, removing the repository from the configuration coupled with deletion of the corresponding storage account (that contained backups) should be a way to go.

Thanks!