Deploying Azure Immutable backups in V12

[az1234567890]

Hi,

We have upgraded our Veeam to version 12 recently and looking to implement Azure Immutable backups

We are aiming to have the following:
Last month of weekly backups (4-5)
12 Monthly Backups
5 yearly backups

We are already storing the Immutable backups on LHR and a copy on Capacity Tier in Azure by using SOBR.
What we would like to achieve is to have last 7 days and Weekly backups stored on Immutable LHR & Capacity Tier in Azure, and Monthly and Yearly in Archive Tier in Azure.
How do we create this set up? Do we need to add all Tiers into SOBR or use Direct backup to Object Storage for some of them?

In the backup copy job, do we set Retention Period to 7 days and enable archival settings to have 4-5 weekly backups, 12 monthly and 5 yearly and then use the Move backups older than x days...?


How about Azure Storage account(s)?
a) i only found this article that explains how to configure Azure Storage - https://www.veeam.com/kb4416 (we are aware we will need to create new Storage Account for Immutable backups)
b) From reading this forum i found out that the only way to delete "Immutable backups" is stop paying for the subscription, so is it highly recommended to deploy you Immutable backups on separate subscription?
c) Do we need to create separate storage account for Capacity tier(HOT) and then another storage account for Archive Tier(COOL)?
d) When i'm creating Storage Account i only have two access tiers: HOT and COOL. Does it mean the only way to utilize Archive tier is to move the data to Archive Tier? When i click on three dots next to a file i'm able to change Access Tier to Archive.

Thanks

[Mildur]

Hello az

If you want to use an Archive Tier, a SOBR is still required.

How do we create this set up? Do we need to add all Tiers into SOBR or use Direct backup to Object Storage for some of them?

You have two Options. I would personally go with Option 2. You will have only one job to manage. And it will copy all backups chains from the Hardened Repository again to the new immutable Azure Blob capacity tier.

Option 1 - Hardened Repository as a simple repository + SOBR with direct backup to Azure BLOB
You can add a new SOBR with:
- Azure Blob in the Performance tier, Azure Archive in the Archive Tier
Capacity tier is not required in that scenario. Restore points can be offloaded from the performance tier directly to the archive tier.

Option 2 - single SOBR
Use the existing SOBR and replace the current capacity tier with a new Azure Blob repository. Add also an Azure Archive repository as the archive tier

In the backup copy job, do we set Retention Period to 7 days and enable archival settings to have 4-5 weekly backups, 12 monthly and 5 yearly and then use the Move backups older than x days...?

The Job targeting the SOBR must have this retention settings.

a) i only found this article that explains how to configure Azure Storage - https://www.veeam.com/kb4416 (we are aware we will need to create new Storage Account for Immutable backups)

Please follow that article to set up the storage account/container before adding it to veeam.

b) From reading this forum i found out that the only way to delete "Immutable backups" is stop paying for the subscription, so is it highly recommended to deploy you Immutable backups on separate subscription?

The only way to get rid of immutable backup data is stop paying your bills, or delete your Microsoft tenant. I wouldn't do that for my main Microsoft tenant. I'm sure Microsoft don't like it someone not paying there bills.
That's why a independent tenant may be useful for the backups.

c) Do we need to create separate storage account for Capacity tier(HOT) and then another storage account for Archive Tier(COOL)?

Archive Tier is not COOL storage. Our Archive Tier uses another storage tier:
Azure Archive Storage --> https://azure.microsoft.com/en-us/products/storage
Accesstier "Archive Tier" --> https://learn.microsoft.com/en-us/azure ... ccess-tier

You only have to add it as an Azure Archive Storage in the Veeam console, and we will take care to flag those blobs as archive blobs. Azure will then store them on the archive access tier:
https://helpcenter.veeam.com/docs/backu ... ml?ver=120

d) When i'm creating Storage Account i only have two access tiers: HOT and COOL. Does it mean the only way to utilize Archive tier is to move the data to Archive Tier? When i click on three dots next to a file i'm able to change Access Tier to Archive.

You don't have todo it manually. Blobs/Objects going to Archive storage is controlled by a Flag when Veeam offloads the blobs.

Best,
Fabian

[az1234567890]

Hi Fabian,

Thank you very much for clarifying all this for me, i have few more questions:

1) We have
- "Backup job" to backup storage
- "Backup Copy Job" from backup storage to SOBR
- in SOBR we have:
1) LHR
2) Capacity Tier
3) Archive Tier

If we set our retention policy on the "Backup Copy Job to SOBR" to 7 days and enable archival settings to have 4-5 weekly backups, 12 monthly and 5 yearly we will have:

7 days of backups on LHR and Capacity tier (if we select the "Copy backups to object storage as soon as they are created" on the Capacity Tier on SOBR)
Do we need to set "Move backups to object storage as they age out of the operational window? If the retention policy is 7 days they should be deleted after 7 days, is that correct?
if i set "Archive GFS backups older than 7 days" in the Archive tier on SOBR, will it archive backups or this value has to be lower than retention?
How do we archive only monthly and yearly backups to Archive Tier and keep the weekly only on the LHR&Capacity tier(on Capacity tier last 3-4 weekly backups)?
If we Archive Weekly ones and delete them after 4 weeks we will be charged for an early deletion

to sumamrize above:
daily backups - on backups storage, LHR (immutable) and Capacity Tier (Immutable) last 7 days of backups
Weekly backups (3-4 weekly backups) - on Capacity Tier (Immutable)
Monthly and yearly (12 motnhs, 5 years) - On Archive Tier (Immutable)

2) Storage account - 1 storage account, and 1 container for each - Capacity Tier and Archive Tier and follow KB to create account and containers?


Thanks

[Mildur]

7 days of backups on LHR and Capacity tier (if we select the "Copy backups to object storage as soon as they are created" on the Capacity Tier on SOBR)

You will have 7-14 days of backups with weekly full backups. We cannot remove the first full backup after exactly 7 days. You wouldn't be able to restore from the dependent incremental backup files. So we have to wait till the new backup chain reaches 7 days, then we can remove the old VBK and VIB files.
https://helpcenter.veeam.com/docs/backu ... ml?ver=120

Do we need to set "Move backups to object storage as they age out of the operational window? If the retention policy is 7 days they should be deleted after 7 days, is that correct?

You have 7 days retention set in your backup copy job. The restore points will be deleted after approximately 14 days. Move is only used if you want to keep fewer restore points on your performance tier.

if i set "Archive GFS backups older than 7 days" in the Archive tier on SOBR, will it archive backups or this value has to be lower than retention?
How do we archive only monthly and yearly backups to Archive Tier and keep the weekly only on the LHR&Capacity tier(on Capacity tier last 3-4 weekly backups)?
If we Archive Weekly ones and delete them after 4 weeks we will be charged for an early deletion

With the default setting for the archive tier, your weekly GFS backups (keep 5 weeks) will stay on the capacity tier and are not moved. Check out the setting "Archive backups only if the remaining retention time is above minimal storage period". It must be enabled --> https://helpcenter.veeam.com/docs/backu ... ml?ver=120

2) Storage account - 1 storage account, and 1 container for each - Capacity Tier and Archive Tier and follow KB to create account and containers?

Sounds good to me

Best,
Fabian

[apolloxm]

The only way to get rid of immutable backup data is stop paying your bills, or delete your Microsoft tenant. I wouldn't do that for my main Microsoft tenant. I'm sure Microsoft don't like it someone not paying there bills.

Can you explain more about this? as I understood, We can delete the data after the immutable days has been expired. For example, If I set the immutable to 12days, we should be cleanup all the data from azure side?

[Mildur]

Of course, after immutability period ended, our software will remove those restore points if they are also out of their backup retention period. Or you can delete the backups from the Veeam backup console.
Manual deletion of all objects in Azure is also possible if you want to delete the Azure Blob container completely.

But consider using GFS backups and direct backup to Azure. You configure a retention of 10 years for the yearly backups. Those yearly GFS backups will be immutable for 10 years.
Now you decide you don't want to use Azure anymore for your backups. But you cannot delete those. You must pay the used storage in the Azure tenant for 10 years until you are able to remove those backups.
In such a case, the only option to not have to pay for 10 years is to have a dedicated Azure Tenant for your backup data. Stop paying Microsoft and the tenant will be most likely deleted with all it's data inside.

Best,
Fabian

[Eamonn Deering]

Re: Those yearly GFS backups will be immutable for 10 years.

If I set Immutable for 14 days and I retain data for 10 years why would any Job / Repo in Veeam think I want Immutable for 10 Years.
Is there a KB on this?
Thanks in advance.
Eamonn

[Mildur]

Hello EamonnD

For which scenario is your question?
Direct to Object Storage is documented here:

https://helpcenter.veeam.com/docs/backu ... ml?ver=120

If retention policy for backups with GFS flags, backups created by VeeamZIP jobs and exported backup files exceeds immutability settings, Veeam Backup & Replication applies retention that is defined for these types of backups. Immutability settings defined for an object storage repository are ignored.

Best,
Fabian

[Eamonn Deering]

I believe my questions are answered in this.

object-storage-as-a-backup-target-f52/v ... 86009.html

Thanks for the reply.