Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Cross-tenant restore lets you restore vaulted backup data from one Microsoft Entra tenant (the source tenant) to a different tenant (the target tenant). You create a mapping between a source vault and a target vault, and then restore from the target tenant. Cross-tenant restore supports Recovery Services vaults and Backup vaults.
Important
Cross-tenant restore for Azure Backup is currently in preview. The Supplemental Terms of Use for Microsoft Azure Previews include additional legal terms that apply to Azure features that are in beta, in preview, or otherwise not yet released into general availability.
Use cases
Use cross-tenant restore in scenarios such as:
- Tenant lockout: You lose access to the source tenant and need to recover your data in another tenant that you control.
- Ransomware attack: The source tenant is compromised, and you need to recover your data in a clean, isolated tenant.
- Tenant consolidation: You merge tenants and need to bring protected data into the consolidated tenant.
- Cross-tenant disaster recovery: You need to recover workloads in a different tenant as part of a disaster recovery operation.
How cross-tenant restore works
Cross-tenant restore involves the following entities:
| Entity | Tenant | Description |
|---|---|---|
| Source vault | Source tenant | The vault that the data source backs up to. |
| Data source | Source tenant | The protected resource, such as a virtual machine. |
| Backup data | Microsoft-managed tenant | Azure Backup stores backup data in storage accounts in a tenant that Microsoft manages. |
| Target vault | Target tenant | The vault that you restore from. A Resource Guard in the target tenant must protect it. |
To restore across tenants:
- During normal operations, create and verify a vault mapping between the source vault and the target vault, before an incident affects access to the source tenant.
- In the target vault, browse the protected items that the mapping surfaces from the source vault.
- Select a recovery point, and restore the data to the target tenant.
Because the target vault must be associated with a Resource Guard, multi-user authorization protects the mapping operation.
Supported workloads and limitations
Cross-tenant restore supports alternate location restore only. It doesn't support original location restore. Only vaulted recovery points are eligible. Snapshot-only recovery points aren't eligible. The following table lists additional workload-specific limitations.
| Vault type | Workload | Limitations |
|---|---|---|
| Recovery Services vault | Azure Virtual Machines | Confidential VMs, VMs encrypted with Azure Disk Encryption (ADE), and archive-tier recovery points aren't supported. |
| Recovery Services vault | Azure Files | None. |
| Recovery Services vault | SQL Server in Azure VM | SQL instance restore and archive-tier recovery points aren't supported. |
| Recovery Services vault | SAP HANA in Azure VM | HANA instance restore isn't supported. |
| Recovery Services vault | SAP ASE in Azure VM | None. |
| Backup vault | Azure Database for PostgreSQL - Flexible Server | None. |
| Backup vault | Azure Blobs | None. |
| Backup vault | Azure Cosmos DB | None. |
| Backup vault | Azure Data Lake Storage | None. |
| Backup vault | Azure Kubernetes Service (AKS) | None. |
Region availability
| Vault type | Supported regions |
|---|---|
| Recovery Services vault | All Azure public regions |
| Backup vault | West Europe, North Europe, East US, UK South, Australia East, Australia Southeast, and Brazil South |
Considerations
- Configure the mapping in advance as part of your recovery planning. Creating a mapping requires access to the source tenant and the Backup Contributor role on the source vault. If you lose that access before a mapping exists, you can't create the mapping solely from the target tenant. With an existing mapping, authorized users can restore from the target tenant without signing in to the source tenant.
- Creating and keeping an empty target vault incurs no Azure Backup charge for the vault itself. Costs for restored resources and any subsequent backup protection are separate. For advance setup, see Prerequisites.
- The source vault and protected item must exist and must not be deleted when you restore. Only vaulted recovery points are eligible, as described in Supported workloads and limitations.
- While a mapping exists, you can't delete the source vault, the target vault, or a protected item in the source vault. Delete the mapping first.
- Cross-tenant restore requires a Resource Guard in the target tenant and specific Azure roles. For details, see Prerequisites and Assign the required roles in the tutorial.