Back up an Azure VM by using the Enhanced policy

Follow these steps:

1. In the Azure portal, select a Recovery Services vault to back up the VM.

2. Under Backup, select Backup policies.

   

3. Select + Add.

   

4. On the Select policy type pane, select Azure Virtual Machine.

5. On the Create policy pane, perform the following actions:

   • Policy subtype: Select the Enhanced type.

     

   • Backup schedule: You can select the frequency as Hourly, Daily, or Weekly.

     With the backup schedule set to Hourly, the default selection for the start time is 8 AM. The schedule is Every 4 hours, and the duration is 24 hours. Hourly backup has a minimum recovery point objective (RPO) of 4 hours and a maximum of 24 hours. You can set the backup schedule to 4, 6, 8, 12, and 24 hours, respectively.

   • Instant Restore: You can set the retention of a recovery snapshot from 1 to 30 days. The default value is set to 7.

   • Retention range: Options for retention range are autoselected based on the backup frequency you choose. The default retention for daily, weekly, monthly, and yearly backup points are set to 180 days, 12 weeks, 60 months, and 10 years, respectively. You can customize these values as required.

   

   Note

   The maximum limit of the instant recovery point retention range depends on the number of snapshots that you take per day. If the snapshot count is more (for example, a frequency of every 4 hours in a duration of 24 hours, so six scheduled snapshots), then the maximum allowed days for retention reduces.

   If you choose the lower RPO of 12 hours, the snapshot retention increases to 30 days.

6. Select Create.

To create an Enhanced backup policy or update the policy, run the following cmdlets:

Step 1: Create the backup policy

$SchPol = Get-AzRecoveryServicesBackupSchedulePolicyObject -PolicySubType "Enhanced" -WorkloadType "AzureVM" -ScheduleRunFrequency “Hourly”  

The parameter ScheduleRunFrequency:Hourly is now also an acceptable value for the Azure VM workload.

The output object for this cmdlet contains the following extra fields for the Azure VM workload, if you create an hourly policy:

• [-ScheduleWindowStartTime <DateTime>]
• [-ScheduleRunTimezone <String>]
• [-ScheduleInterval <Int>]
• [-ScheduleWindowDuration <Int>]

Step 2: Set the backup schedule objects

$schedulePolicy = Get-AzRecoveryServicesBackupSchedulePolicyObject -WorkloadType AzureVM -BackupManagementType AzureVM -PolicySubType Enhanced -ScheduleRunFrequency Hourly
$timeZone = Get-TimeZone -ListAvailable | Where-Object { $_.Id -match "India" }
$schedulePolicy.ScheduleRunTimeZone = $timeZone.Id
$windowStartTime = (Get-Date -Date "2022-04-14T08:00:00.00+00:00").ToUniversalTime()
$schPol.HourlySchedule.WindowStartTime = $windowStartTime
$schedulePolicy.HourlySchedule.ScheduleInterval = 4
$schedulePolicy.HourlySchedule.ScheduleWindowDuration = 23

In this sample cmdlet:

• The first command gets a base Enhanced hourly SchedulePolicyObject for the WorkloadType Azure VM, and then stores it in the $schedulePolicy variable.

• The second and third commands fetch the India time zone and update the time zone in $schedulePolicy.

• The fourth and fifth commands initialize the schedule window start time and update $schedulePolicy.

  Note

  The start time must be in UTC even if the time zone isn't UTC.

• The sixth and seventh commands update the interval (in hours) after which the backup is retriggered on the same day. The commands also update the duration (in hours) for which the schedule will run.

Step 3: Create the backup retention policy

Get-AzRecoveryServicesBackupRetentionPolicyObject -WorkloadType AzureVM -ScheduleRunFrequency "Hourly" 

• The parameter ScheduleRunFrequency:Hourly is also an acceptable value for an Azure VM workload.
• If ScheduleRunFrequency is hourly, you don't need to enter a value for RetentionTimes to the policy object.

Step 4: Set the backup retention policy object

$RetPol.DailySchedule.DurationCountInDays = 365

Step 5: Save the policy configuration

AzRecoveryServicesBackupProtectionPolicy
New-AzRecoveryServicesBackupProtectionPolicy -Name "NewPolicy" -WorkloadType AzureVM -RetentionPolicy $RetPol -SchedulePolicy $SchPol

For the Enhanced policy, the allowed values for snapshot retention are from 1 day to 30 days.

Step 6: Update snapshot retention duration

$bkpPol = Get-AzRecoveryServicesBackupProtectionPolicy -Name "NewPolicy"
$bkpPol.SnapshotRetentionInDays=10
Set-AzRecoveryServicesBackupProtectionPolicy -policy $bkpPol -VaultId <VaultId>

List the Enhanced backup policies

To view the existing Enhanced policies, run the following cmdlet:

Get-AzRecoveryServicesBackupProtectionPolicy -PolicySubType "Enhanced"

For Get-AzRecoveryServicesBackupProtectionPolicy:

• Add the parameter PolicySubType. The allowed values are Enhanced and Standard. If you don't specify a value for this parameter, all policies (Standard and Enhanced) get listed.
• The applicable parameter sets are NoParamSet, WorkloadParamSet, and WorkloadBackupManagementTypeParamSet.
• For non-VM workloads, the allowed value is Standard only.

Configure backup

To configure backup of a Trusted Launch VM or assign a new policy to the VM, run the following cmdlet:

$targetVault = Get-AzRecoveryServicesVault -ResourceGroupName "Contoso-docs-rg" -Name "testvault"
$pol = Get-AzRecoveryServicesBackupProtectionPolicy -Name "NewPolicy" -VaultId $targetVault.ID
Enable-AzRecoveryServicesBackupProtection -Policy $pol -Name "V2VM" -ResourceGroupName "RGName1" -VaultId $targetVault.ID

To create an Enhanced backup policy, run the following command:

az backup policy create --policy {policy} --resource-group MyResourceGroup --vault-name MyVault --name MyPolicy --backup-management-type AzureIaaSVM -PolicySubType "Enhanced"
Policy is passed in JSON format to the create command.

Update an Enhanced backup policy

To update an Enhanced backup policy, run the following command:

az backup policy set --policy {policy} --resource-group MyResourceGroup --vault-name MyVault  -PolicySubType "Enhanced"

List the Enhanced backup policies

To list all existing Enhanced policies, run the following command:

az backup policy list --resource-group MyResourceGroup --vault-name MyVault --policy-sub-type Enhanced --workload-type VM

For the parameter –policy-sub-type, the allowed values are Enhanced and Standard. If you don't specify a value for this parameter, all policies (Standard and Enhanced) get listed.

For non-VM workloads, the only allowed value is Standard.

Configure backup for a VM or assign a new policy to a VM

To configure backup for a VM or assign a new policy to the VM, run the following command:

az backup protection enable-for-vm \
    --resource-group myResourceGroup \
    --vault-name myRecoveryServicesVault \
    --vm $(az vm show -g VMResourceGroup -n MyVm --query id | tr -d '"') \
    --policy-name DefaultPolicy

You can back up Trusted Launch VMs only by using Enhanced policies.

Currently, a non-Trusted Launch VM that used the Standard policy earlier can't start using the Enhanced policy. A VM that uses the Enhanced policy can't be updated to use the Standard policy.