Skip to main content
Virtual machine backup for on-premises workloads using an Azure Recovery Services vault. This guide explains how to protect on-premises virtual machines (Hyper-V, VMware) and physical Windows servers by using an Azure Recovery Services vault as the cloud storage target. It covers supported workloads, the typical protection architecture, preparing the on-premises infrastructure (Microsoft Azure Backup Server or System Center DPM), and the steps to register and start sending recovery points to Azure. Recovery Services vaults are the central storage and management resource for backup and restore in Azure:
  • Store long-term recovery points.
  • Manage backup policies, retention, and restore operations.
  • Provide secure, encrypted transfer of backups from on-premises servers to Azure.
Supported server and workload types Typical on-premises protection architecture and data flow
  • Deploy an on-premises backup orchestration server: Microsoft Azure Backup Server (MABS) or System Center Data Protection Manager (DPM).
  • Register the backup server with a Recovery Services vault in Azure using vault credentials.
  • The backup server keeps a short-term local replica for fast restores (low RTO) and uploads recovery points to the Recovery Services vault for long-term retention and disaster recovery.
  • Data transfer to Azure is encrypted over HTTPS (TLS) to protect data in transit.
Below is an example Recovery Services vault in the Azure portal.
A screenshot of the Microsoft Azure portal showing a Recovery Services vault named "rsv-01" with the Overview tab open. The page highlights Backup and Site Recovery options and a "What's new" list of features (SAP HANA, cross-subscription restore, etc.).
Prepare your on-premises infrastructure (high-level steps) From the vault’s Overview or the Backup center in the Azure portal, click Backup and then Prepare infrastructure. For Hyper-V and VMware scenarios you will typically:
  1. Click Prepare infrastructure in the Recovery Services vault.
  2. Download the installer for Microsoft Azure Backup Server (MABS) or the install media for System Center DPM.
  3. Download the Recovery Services vault credentials file — this file is required to register your on-premises backup server with the vault.
  4. Install and configure MABS or DPM on an on-premises server. During registration, provide the downloaded vault credentials file.
  5. On the backup server, configure protection groups/policies: select workloads, set schedules and retention. The backup server will create an initial replica and upload recovery points to the vault according to policy.
The portal page for preparing infrastructure provides the links to download the backup server and the vault credentials.
A screenshot of the Microsoft Azure portal showing a "Prepare infrastructure" page with steps to install Microsoft Azure Backup Server (MABS) and download vault credentials, including checkboxes and a disabled "Download" button. The page includes brief instructions and a "Learn More" link.
MABS, DPM, and the MARS agent
Use Microsoft Azure Backup Server (MABS) or System Center DPM for VM-level protection and application-consistent backups (SQL Server, Exchange, SharePoint). The Microsoft Azure Recovery Services (MARS) agent is intended for file/folder and system-state backups on Windows machines — it does not provide workload-aware VM backups via Hyper-V/VMware.
Prerequisites and best practices
When installing MABS/DPM, ensure the backup server meets prerequisites: supported OS, required Windows roles and features, sufficient disk for the local replica, and outbound network connectivity to Azure (HTTPS). Always register the server with the Recovery Services vault using the downloaded credentials file and validate initial connectivity before scheduling backups.
Post-registration: monitoring and restore
  • Once your on-premises backup server is registered, the server will create the initial replica and start uploading recovery points according to policy.
  • Local replicas enable fast restores on-premises; the vault stores cloud copies for long-term retention and disaster recovery.
  • Monitor backup health and job status from the Recovery Services vault Overview page or the Backup center in the Azure portal.
Additional resources and references

Watch Video