Tutorial: Protect Azure Cosmos DB with vaulted backup by using the Azure portal

Azure Backup provides vaulted backup for Azure Cosmos DB through an Azure Backup vault. You can configure backup schedules, retain recovery points, and restore backup to a new database account when needed.

This tutorial describes how to protect Azure Cosmos DB with vaulted backup by using Azure Backup via Azure portal.

In this tutorial, you learn how to:

Verify prerequisites for Azure Cosmos DB backup.
Configure vaulted backup.
Run an on-demand backup.
Track backup jobs.

Prerequisites

Before you configure vaulted backup for Azure Cosmos DB by using Azure portal, ensure that you meet the following prerequisites:

Check the supported scenarios and known limitations of Azure Cosmos DB backup.
Identify or create a Backup Vault in the same region where you want to back up the Azure Cosmos DB account.
Identify or create a new backup policy for Azure Cosmos DB.
Review the access permission if present to assign Cosmos DB Long Term Retention Backup Role over the source Cosmos DB account to the Backup Vault.

Configure vaulted backup for Azure Cosmos DB by using Azure portal

To configure vaulted backup for a Cosmos DB account through Resiliency by using Azure portal, follow these steps:

Go to Resiliency, select Overview > Configure protection.

Alternatively, configure backup from the Backup vault pane. Go to Backup vault > Overview, and select Backup.
On the Configure protection pane, select Resource managed by as Azure, Datasource type as Azure Cosmos DB, and Solution as Azure Backup, and then select Continue.
On the Configure Backup pane, on the Basics tab, check if Datasource type appears as Azure Cosmos DB, click Select vault under Vault and choose an existing Backup vault from the dropdown list, and then select Next.
On the Backup policy tab, select a Backup policy that defines the backup schedule and the retention duration, and then select Next.
On the Datasources tab, select the datasource name.

On the Select resources to backup pane, select the Azure Cosmos DB account to back up, and then click Select.

Ensure that the primary write region of the Azure Cosmos DB account is same as that of the Backup vault region.

On the Datasources tab, the Azure Backup service validates if it has all the necessary access permissions to connect to the Cosmos DB account. If one or more access permissions are missing, one of the following error messages appears:

User cannot assign roles or
Role assignment not done.

Error	Cause	Recommendation
User cannot assign roles	This message appears when you (the backup admin) don’t have the write access on the Cosmos DB account as listed under View details.	To assign the necessary permissions on the required resources, select Download role assignment template to fetch the ARM template, and run the template as an administrator.
Role assignment not done	This message appears when you (the backup admin) have the write access on the Cosmos DB account to assign missing permissions as listed under View details.	To grant permissions inline, select Assign missing roles.

Once the permission assignment process starts, the missing access permissions on the Cosmos DB account are granted to the backup vault. You can define the scope at which the access permissions must be granted. When the action is complete, revalidation starts.

After the role assignment validation shows Success, select Next.
On the Review + configure tab, select Configure backup.
Protected item is now created.

Run an on-demand backup for Azure Cosmos DB by using the Azure portal

To run an on-demand backup for an Azure Cosmos DB, follow these steps:

Go to Resiliency, and select Backup and recovery > Protected items.
On the Protected items pane, filter Datasource type by Azure Cosmos DB, and select the Cosmos DB instance you want to back up.
On the Protected item pane, under Associated items, select a protected item from the list.
On the Backup instance pane, select Backup Now.