backup of Azure Storage accounts

[sandsturm]

Hi all

I need to create backups of different Azure Storage Accounts, but could not find an option in VBAZ to do that. How can I achieve a backup of a storage account with Veeam?

many thanks and regards,
sandsturm

[hani92]

Hi,

What is it that you are trying to backup in Azure Storage Accounts? Currently VBAz can backup Azure Files and send backups to Azure Blob storage.

[sandsturm]

The point is, that I do not have a clue about all the contents in the different storage accounts. Usually we have different containers within a storageaccount with data of an application. I just need an option to backup these things. A storage account provides the option to store data in containers (blobs), File shares (as you said), queues or tables. I just need the option to have a generic option to backup data of these storage accounts, doesn't matter whats in it.

[sandsturm]

it looks like Veeam VBR version 12.1 will bring the capability to backup data from Azure storage accounts at least for blob storage accounts and that should solve my problem.

[Mildur]

Hi Sandsturm

Correct. You will be able to protect the content of an Azure Blob storage. Stay tuned for a release till end of this year.

Best,
Fabian

[sandsturm]

I just read here: https://helpcenter.veeam.com/docs/backu ... ob-storage that a backup of storage accounts encrypted with a customer managed key cannot be backed up?
My question is then: How does veeam create backups of "standard" Storage accounts? Every storage account is encrypted per default. The difference is only the customer managed key, which is used or even not used. Is the process different and is there no way to create backups of storage accounts encrypted with a customer managed key?

thx,
sandsturm

[Dima P.]

No difference, both are supported and we work correctly with Microsoft-managed and customer-managed encryption keys. The note in the help center was aimed to mention that customer-provided encryption keys for specific blobs are not supported. I've asked TW to correct the statement.

[sandsturm]

No difference, both are supported and we work correctly ...

That is great news!

thx,
sandsturm

[gcg]

Currently VBAz can backup Azure Files and send backups to Azure Blob storage.

I don't think you can take an Azure Files backup and send to Azure Blob storage. Azure Files backups are just snapshot management front-end to Azure snaps. VBAZ doesn't do any sort of copying that to immutable or anything else.

If you have VBR, though, then you can now with 12.1.2.172 backup "object storage" as "unstructured backups" so you can then get that actually copied into immutable backups and archival spaces, but VBAZ doesn't do that natively (at least not that I could find digging through all of the documentation on VBAZ and Azure Files backups.

[Dima P.]

Hello gcg,

You can mount Azure Files as NFS or SMB and backup such data via Veeam B&R Unstructured Data backup with all the capabilities preserved. Thank you!

[albertwt]

backup such data via Veeam B&R Unstructured Data backup

@Dima, does it mean, the backup can be done using the VBR without the Veeam Backup for Microsoft Azure ?

[Dima P.]

Hello albertwt,

Correct, object storage backup is a feature of Veeam B&R, so in order to backup data under your Azure storage account you will need to use Veeam B&R. Thank you!

[albertwt]

Thank you Dima for the confirmation.

[sandsturm]

Hi all

I configured the backup of Azure storage accounts and I am able to backup such storage accounts, as long as I use shared key credentials to access the storage account. As soon as I change this to use Entra ID instead of shared keys, the backup does not work any more. I had a veeam case to this topic (Case #07428436), but were not able to solve the issue. Veeam support said, that they cannot help, because it is something network related in our environment, what is not correct in my opinion. Our VBR server can connect to the internet (and Azure services) only via http proxy, therefore all communication to such services need to traverse the http proxy. Our Azure storage Accounts do not have a public IP address and are reachable via "internal" network (VPN connection from onpremise to Azure). As I said, everything works fine, as long as I use shared keys for the authentication. I'm not sure if veeam tries to access the storage account now as well via http proxy and not via "internal network", as soon as I use Entra ID for the authentication.
- Shared key authentication is not allowed to be compliant with our company internal security guidelines.
- Shared key is also difficult from an operating perspective, because each Storage Account has other shared keys, therefore not a feasible solution, if I want to backup hundreds of Storage accounts.
- we had in the past some cases, where veeam was not able to handle connections via http proxy always well. For some use cases, veeam was not able to use the configured http proxy settings, for other use cases, it worked flawless (at the same time). Therefore I'm not sure if the current problem has the same reason....

I really need a solution to be able to backup a lot of Azure storage accounts. Is maybe someone out there, which has the same problem, but already solved?

thx,
sandsturm

[Vitaliy S.]

Hi sandsturm,

For the sake of the experiment, have you tried using the Entra ID app authentication without a proxy? It would allow us to focus either on the "proxy" or the "Entra ID app".

Thanks!

P.S. I've asked our QA team to double-check the Entra ID app scenario. Once I have any updates, I will come back to you.

[Vitaliy S.]

A quick update from the QA team > authentication via the Entra ID app is fully supported and works fine in this scenario, so it looks like the issue is in "the HTTP proxy", and that, unfortunately, will be tricky to troubleshoot over the forums.

[Backup.Operator]

Hi Folks,

Can the VBR Server backup Azure Storage account content to OnPremise or another location like Wasabi cloud?

[Mildur]

Yes.

Our "Object Storage Backup Job" in Veeam Backup & Replication can store backups in on-premises repositories and Object Storage like Wasabi.
All supported repositories are documented in our Help Center.

Best,
Fabian

[albertwt]

Hi Folks,

Can the VBR Server backup Azure Storage account content to OnPremise or another location like Wasabi cloud?

Based on this official statement from Microsoft, yes Veeam Backup & Replication (VBR) supports more than just an Azure Storage account

Code: Select all

https://learn.microsoft.com/en-us/azure/storage/solution-integration/validated-partners/backup-archive-disaster-recovery/veeam/veeam-solution-guide#protect-azure-workloads-with-veeam

[sandsturm]

A quick update from the QA team > authentication via the Entra ID app is fully supported and works fine in this scenario, so it looks like the issue is in "the HTTP proxy", and that, unfortunately, will be tricky to troubleshoot over the forums.

Hi Vitaly
I just had a look at the network traffic with wireshark and saw that maybe the ciphers used for the TLS1.2 connection are not allowed by our Veeam backup server when using EntraID credentials instead of shared keys. (weak ciphers are disabled by policy on our servers). I made a screenshot of wireshark (IPs and DNS names are removed from screenshot and masked with a logical name)
Screenshot: https://snipboard.io/hzedij.jpg
Not sure, if I'm on the right way, but maybe someone can help me, telling me which ciphers need to be allowed to enable authentication to the storage account with Entra ID credentials?

list of allowed and disabled TLS 1.2 ciphers on the VBR server:
Screenshot: https://snipboard.io/mVYH57.jpg

thx,
sandsturm

[Vitaliy S.]

Hey @sandsturm,

I've asked our QA team this question, maybe you're on the right track.

Thanks!

[sandsturm]

cool, thx a lot for your help!

sandsturm