Skip to main content
Virtual machine backup for Azure managed disks This guide explains how to back up an Azure virtual machine (VM) that uses managed disks. It covers how Azure Backup coordinates snapshots, how to enable protection from the Azure portal, how to run and monitor backups, and how to recover files or entire VMs. Overview — how Azure VM backup works When you enable backup for an Azure VM, the Azure Backup service orchestrates the entire workflow. Key points:
  • A VM backup extension is deployed (if not already present) to coordinate in-guest tasks required for consistent snapshots.
    • On Windows VMs this coordinates with Volume Shadow Copy Service (VSS) for application-consistent backups.
    • On Linux VMs it uses pre/post scripts to quiesce applications when needed.
  • A backup policy defines schedule and retention (for example, daily at 04:00 UTC retained for 30 days, with additional weekly/monthly/yearly retention points and instant restore snapshot retention).
  • At each scheduled backup the backup extension creates snapshots of the VM’s managed disks. Azure Backup then transfers only incremental changed blocks from those snapshots to the Recovery Services vault over HTTPS, minimizing transfer and storage.
  • If disks are encrypted (for example using Azure Disk Encryption with keys in Azure Key Vault), Azure Backup coordinates with the key resources so snapshots and restores can be decrypted when required.
A diagram showing the Azure Virtual Machine backup process: VM managed disks create instant recovery snapshots that are transferred over HTTPS to the Azure Backup Service (Recovery Services Vault) using incremental blocks and governed by backup policy management.
Recommended reading: Enabling backup for a VM — portal walkthrough Follow these steps in the Azure portal to protect a VM:
  1. Open the Azure portal, go to Virtual Machines, and select the VM you want to protect (for example, “RSV Demo 1”).
  2. Backups are stored and managed in a Recovery Services vault. You can:
    • Create or open a Recovery Services vault (recommended if you plan to onboard multiple VMs), or
    • Enable backup directly from the VM blade for a one-off enablement.
  3. From the Recovery Services vault, select Backup. For workload type choose “Azure Virtual Machine.” The portal may show options for vault redundancy and enhanced mode. Select or create a backup policy.
Backup policy: what you configure
A screenshot of the Microsoft Azure portal showing the "Configure backup" and "Create policy" dialogs for a Recovery Services vault, with options for backup policy type, schedule, instant restore retention, and retention range. The page shows settings like daily backup time, timezone, retention days, and an "Enable backup" / "OK" action button.
  1. After creating or selecting the policy, add virtual machines to the policy. The portal lists VMs in the same region — select one or more and click OK.
When you enable backup, the Recovery Services vault validates that it can deploy the backup extension. Clicking Enable Backup deploys the extension to the VM; this extension orchestrates snapshot creation and coordinates application-consistent backups when requested.
A screenshot of the Microsoft Azure portal showing a deployment named "ConfigureProtection-1702709511650" with the status "Deployment is in progress." The right pane shows operation details (provisioning operation: Create, provisioning state: Running, timestamp and tracking IDs).
Taking the initial backup and monitoring After protection is configured, trigger the initial backup:
  • Recovery Services vault -> Backup Items -> Azure Virtual Machine -> select the VM -> View details -> Backup Now.
A backup job has two main phases:
  • Snapshot creation: the VM extension quiesces applications for application-consistent backups (if requested) and creates disk snapshots.
  • Data transfer: incremental changed blocks from those snapshots are sent over HTTPS to the vault.
Monitor progress from the Jobs blade in the Recovery Services vault to view job status and details.
A screenshot of the Microsoft Azure portal showing the "Backup Jobs" page with a table of backup operations (workload names, operation type, status, start time and duration). It lists Azure Virtual Machine and Azure Storage backups with statuses like "In progress" and "Completed."
When the job succeeds, the Recovery Services vault shows the backup item with its last backup time and available recovery points.
A screenshot of the Microsoft Azure portal showing a backup item named "rsv-demo-1" in a Recovery Services vault, with essentials like subscription, backup policy, and a recent recovery point listed. The page shows backup pre-check and last backup status as passed/success.
Recovery options — file-level and VM restore Use the following methods to recover data from backups. File-level recovery process
  • Select File Recovery from the VM’s backup item.
  • Choose a recovery point and download the recovery tool/executable the portal provides.
  • Use the temporary password shown in the portal to mount the recovery snapshot.
  • Copy the required files from the mounted volume, then unmount when finished.
A Microsoft Azure File Recovery screen showing steps to select a restore point and download a script to mount recovery disks. The page displays a "Download Executable" button, a password field, and an "Unmount Disks" option.
Full VM restore (or restore disks only)
  • Choose a restore point and pick the restore configuration: “Create new” (provision a new VM from the recovery point) or “Replace existing” (replace disks on the running VM).
  • Alternatively, restore disks only and select the target resource group and staging location. The operation creates restored managed disks or VHDs, which you can then use to rebuild or repair a VM, or mount to recover files.
A screenshot of the Microsoft Azure portal showing the "Restore Virtual Machine" form for a VM named rsv-demo-1, with selectable restore point, restore configuration (create new/replace existing), restore type, resource group, and staging location fields. The page includes guidance notes and a blue "Restore" button at the bottom.
Important notes and best practices
  • Use a Recovery Services vault per region or per environment according to your organizational isolation and retention needs.
  • Assign a backup policy that meets your RPO/RTO requirements and apply it consistently to similar workloads.
  • Test restores regularly (both file-level and full VM restores) to validate your recovery procedures.
If you use disk encryption, ensure the Key Vault and access policies are configured so Azure Backup can access keys/secrets for encryption/decryption during backup and restore. Failing to configure Key Vault access can prevent successful restores.
Wrap-up You have now configured backup for an Azure VM (managed disks), learned how the Azure Backup service creates and transfers incremental snapshots to a Recovery Services vault, and practiced both file-level and full VM restore flows. Apply these steps to protect additional VMs or explore backing up other Azure workloads. Further references:

Watch Video