Share via

az dataprotection backup-vault

  • Reference

Note

This reference is part of the dataprotection extension for the Azure CLI (version 2.57.0 or higher). The extension will automatically install the first time you run an az dataprotection backup-vault command. Learn more about extensions.

Manage backup vault with dataprotection.

Commands

Name Description Type Status
az dataprotection backup-vault create

Create a BackupVault resource belonging to a resource group.

 Extension GA
az dataprotection backup-vault delete

Delete a BackupVault resource from the resource group.

 Extension GA
az dataprotection backup-vault list

Gets list of backup vault in a subscription or in a resource group.

 Extension GA
az dataprotection backup-vault list-from-resourcegraph

List backup vaults across subscriptions, resource groups and vaults.

 Extension GA
az dataprotection backup-vault resource-guard-mapping

Manage ResourceGuard mappings for a backup vault.

 Extension GA
az dataprotection backup-vault resource-guard-mapping create

Create a ResourceGuard mapping.

 Extension GA
az dataprotection backup-vault resource-guard-mapping delete

Delete the ResourceGuard mapping.

 Extension GA
az dataprotection backup-vault resource-guard-mapping show

Get the ResourceGuard mapping object associated with the vault, and that matches the name in the request.

 Extension GA
az dataprotection backup-vault show

Get a resource belonging to a resource group.

 Extension GA
az dataprotection backup-vault update

Updates a BackupVault resource belonging to a resource group. For example, updating tags for a resource.

 Extension GA
az dataprotection backup-vault wait

Place the CLI in a waiting state until a condition is met.

 Extension GA

az dataprotection backup-vault create

Create a BackupVault resource belonging to a resource group.

az dataprotection backup-vault create --resource-group
                                      --storage-setting
                                      --vault-name
                                      [--azure-monitor-alerts-for-job-failures {Disabled, Enabled}]
                                      [--cmk-encryption-key-uri]
                                      [--cmk-encryption-state {Disabled, Enabled, Inconsistent}]
                                      [--cmk-identity-type {SystemAssigned, UserAssigned}]
                                      [--cmk-infra-encryption {Disabled, Enabled}]
                                      [--cmk-uami]
                                      [--cross-region-restore-state {Disabled, Enabled}]
                                      [--cross-subscription-restore-state {Disabled, Enabled, PermanentlyDisabled}]
                                      [--e-tag]
                                      [--immutability-state {Disabled, Locked, Unlocked}]
                                      [--location]
                                      [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                                      [--retention-duration-in-days]
                                      [--soft-delete-state {AlwaysOn, Off, On}]
                                      [--tags]
                                      [--type]
                                      [--uami]

Examples

Create BackupVault

az dataprotection backup-vault create --type "None" --location "WestUS" --azure-monitor-alerts-for-job-failures "Enabled" --storage-setting "[{type:'LocallyRedundant',datastore-type:'VaultStore'}]" --tags key1="val1" --resource-group "SampleResourceGroup" --vault-name "swaggerExample"

Create BackupVault With MSI

az dataprotection backup-vault create --type "systemAssigned" --location "WestUS" --azure-monitor-alerts-for-job-failures "Enabled" --storage-setting "[{type:'LocallyRedundant',datastore-type:'VaultStore'}]" --tags key1="val1" --resource-group "SampleResourceGroup" --vault-name "swaggerExample"

Create BackupVault With CMK Encryption

az dataprotection backup-vault create -g "resourceGroupName" -v "vaultName" --location "eastasia" --storage-setting "[{type:'LocallyRedundant',datastore-type:'VaultStore'}]" --type "UserAssigned" --user-assigned-identities '{"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/samplerg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/sampleuami":{}}' --cmk-encryption-key-uri "https://samplekvazbckp.vault.azure.net/keys/testkey/3cd5235ad6ac4c11b40a6f35444bcbe1" --cmk-encryption-state "Enabled" --cmk-identity-type "UserAssigned" --cmk-infrastructure-encryption "Enabled" --cmk-user-assigned-identity-id  "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/samplerg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/sampleuami"

Required Parameters

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--storage-setting --storage-settings

Storage Settings. Usage: --storage-setting "[{type:'LocallyRedundant',datastore-type:'VaultStore'}]" Support shorthand-syntax, json-file and yaml-file. Try "??" to show more. Singular flags: --storage-settings.

--vault-name -v

The name of the backup vault.

Optional Parameters

--azure-monitor-alerts-for-job-failures --job-failure-alerts

Property that specifies whether built-in Azure Monitor alerts should be fired for all failed jobs.

Accepted values: Disabled, Enabled
--cmk-encryption-key-uri

The Key URI of the CMK key to be used for encryption. To enable auto-rotation of keys, exclude the version component from the Key URI.

--cmk-encryption-state

Enable CMK encryption state for a Backup Vault.

Accepted values: Disabled, Enabled, Inconsistent
--cmk-identity-type

The identity type to be used for CMK encryption - SystemAssigned or UserAssigned Identity.

Accepted values: SystemAssigned, UserAssigned
--cmk-infra-encryption --cmk-infrastructure-encryption

Enable/Disable infrastructure encryption with CMK on this vault. Infrastructure encryption must be configured only when creating the vault.

Accepted values: Disabled, Enabled
--cmk-uami --cmk-user-assigned-identity-id

This parameter is required if the identity type is UserAssigned. Add the user assigned managed identity id to be used which has access permissions to the Key Vault.

--cross-region-restore-state --crr-state

Set the CrossRegionRestore state. Once enabled, it cannot be set to disabled.

Accepted values: Disabled, Enabled
--cross-subscription-restore-state --csr-state

CrossSubscriptionRestore state.

Accepted values: Disabled, Enabled, PermanentlyDisabled
--e-tag

Optional ETag.

--immutability-state

Immutability state.

Accepted values: Disabled, Locked, Unlocked
--location -l

Location. Values from: az account list-locations. You can configure the default location using az configure --defaults location=<location>. When not specified, the location of the resource group will be used.

--no-wait

Do not wait for the long-running operation to finish.

Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--retention-duration-in-days --soft-delete-retention

Soft delete retention duration.

Default value: 14.0
--soft-delete-state

State of soft delete.

Accepted values: AlwaysOn, Off, On
Default value: On
--tags

Space-separated tags: key[=value] [key[=value] ...]. Use "" to clear existing tags. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--type

The identityType which can be "SystemAssigned", "UserAssigned", "SystemAssigned,UserAssigned" or "None".

--uami --user-assigned-identities

Gets or sets the user assigned identities. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az dataprotection backup-vault delete

Delete a BackupVault resource from the resource group.

az dataprotection backup-vault delete [--ids]
                                      [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                                      [--resource-group]
                                      [--subscription]
                                      [--vault-name]
                                      [--yes]

Examples

Delete BackupVault

az dataprotection backup-vault delete --resource-group "SampleResourceGroup" --vault-name "swaggerExample"

Optional Parameters

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

--no-wait

Do not wait for the long-running operation to finish.

Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--vault-name -v

The name of the backup vault.

--yes -y

Do not prompt for confirmation.

Default value: False
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az dataprotection backup-vault list

Gets list of backup vault in a subscription or in a resource group.

az dataprotection backup-vault list [--max-items]
                                    [--next-token]
                                    [--resource-group]

Examples

List backup vault in a subscription

az dataprotection backup-vault list

List backup vault in a resource group

az dataprotection backup-vault list -g sarath-rg

Optional Parameters

--max-items

Total number of items to return in the command's output. If the total number of items available is more than the value specified, a token is provided in the command's output. To resume pagination, provide the token value in --next-token argument of a subsequent command.

--next-token

Token to specify where to start paginating. This is the token value from a previously truncated response.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az dataprotection backup-vault list-from-resourcegraph

List backup vaults across subscriptions, resource groups and vaults.

az dataprotection backup-vault list-from-resourcegraph [--resource-groups]
                                                       [--subscriptions]
                                                       [--vault-id]
                                                       [--vaults]

Examples

Fetch a specific backup vault

az dataprotection backup-vault list-from-resourcegraph --subscriptions 00000000-0000-0000-0000-000000000000 --resource-groups sample_rg --vaults sample_vault

Optional Parameters

--resource-groups

List of resource groups.

--subscriptions

List of subscription Ids.

--vault-id

Specify vault id filter to apply.

--vaults

List of vault names.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az dataprotection backup-vault show

Get a resource belonging to a resource group.

az dataprotection backup-vault show [--ids]
                                    [--resource-group]
                                    [--subscription]
                                    [--vault-name]

Examples

Get BackupVault

az dataprotection backup-vault show --resource-group "SampleResourceGroup" --vault-name "swaggerExample"

Get BackupVault With MSI

az dataprotection backup-vault show --resource-group "SampleResourceGroup" --vault-name "swaggerExample"

Optional Parameters

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--vault-name -v

The name of the backup vault.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az dataprotection backup-vault update

Updates a BackupVault resource belonging to a resource group. For example, updating tags for a resource.

az dataprotection backup-vault update [--add]
                                      [--azure-monitor-alerts-for-job-failures {Disabled, Enabled}]
                                      [--cmk-encryption-key-uri]
                                      [--cmk-encryption-state {Disabled, Enabled, Inconsistent}]
                                      [--cmk-identity-type {SystemAssigned, UserAssigned}]
                                      [--cmk-uami]
                                      [--cross-region-restore-state {Disabled, Enabled}]
                                      [--cross-subscription-restore-state {Disabled, Enabled, PermanentlyDisabled}]
                                      [--force-string {0, 1, f, false, n, no, t, true, y, yes}]
                                      [--ids]
                                      [--immutability-state {Disabled, Locked, Unlocked}]
                                      [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                                      [--operation-requests]
                                      [--remove]
                                      [--resource-group]
                                      [--retention-duration-in-days]
                                      [--set]
                                      [--soft-delete-state {AlwaysOn, Off, On}]
                                      [--subscription]
                                      [--tags]
                                      [--tenant-id]
                                      [--type]
                                      [--uami]
                                      [--vault-name]

Examples

Patch BackupVault

az dataprotection backup-vault update --azure-monitor-alerts-for-job-failures "Enabled" --tags newKey="newVal" --resource-group "SampleResourceGroup" --vault-name "swaggerExample"

Optional Parameters

--add

Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.

--azure-monitor-alerts-for-job-failures --job-failure-alerts

Property that specifies whether built-in Azure Monitor alerts should be fired for all failed jobs.

Accepted values: Disabled, Enabled
--cmk-encryption-key-uri

The key uri of the Customer Managed Key.

--cmk-encryption-state

Enable CMK encryption state for a Backup Vault.

Accepted values: Disabled, Enabled, Inconsistent
--cmk-identity-type

The identity type to be used for CMK encryption - SystemAssigned or UserAssigned Identity.

Accepted values: SystemAssigned, UserAssigned
--cmk-uami --cmk-user-assigned-identity-id

This parameter is required if the identity type is UserAssigned. Add the user assigned managed identity id to be used which has access permissions to the Key Vault.

--cross-region-restore-state --crr-state

Set the CrossRegionRestore state. Once enabled, it cannot be set to disabled.

Accepted values: Disabled, Enabled
--cross-subscription-restore-state --csr-state

CrossSubscriptionRestore state.

Accepted values: Disabled, Enabled, PermanentlyDisabled
--force-string

When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.

Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

--immutability-state

Immutability state.

Accepted values: Disabled, Locked, Unlocked
--no-wait

Do not wait for the long-running operation to finish.

Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--operation-requests --resource-guard-operation-requests

ResourceGuardOperationRequests on which LAC check will be performed Support shorthand-syntax, json-file and yaml-file. Try "??" to show more. Singular flags: --operation-requests.

--remove

Remove a property or an element from a list. Example: --remove property.list <indexToRemove> OR --remove propertyToRemove.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--retention-duration-in-days --soft-delete-retention

Soft delete retention duration.

--set

Update an object by specifying a property path and value to set. Example: --set property1.property2=<value>.

--soft-delete-state

State of soft delete.

Accepted values: AlwaysOn, Off, On
--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--tags

Resource tags. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--tenant-id

Tenant ID for cross-tenant calls.

--type

The identityType which can be "SystemAssigned", "UserAssigned", "SystemAssigned,UserAssigned" or "None".

--uami --user-assigned-identities

Gets or sets the user assigned identities. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--vault-name -v

The name of the backup vault.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az dataprotection backup-vault wait

Place the CLI in a waiting state until a condition is met.

az dataprotection backup-vault wait [--created]
                                    [--custom]
                                    [--deleted]
                                    [--exists]
                                    [--ids]
                                    [--interval]
                                    [--resource-group]
                                    [--subscription]
                                    [--timeout]
                                    [--updated]
                                    [--vault-name]

Optional Parameters

--created

Wait until created with 'provisioningState' at 'Succeeded'.

Default value: False
--custom

Wait until the condition satisfies a custom JMESPath query. E.g. provisioningState!='InProgress', instanceView.statuses[?code=='PowerState/running'].

--deleted

Wait until deleted.

Default value: False
--exists

Wait until the resource exists.

Default value: False
--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

--interval

Polling interval in seconds.

Default value: 30
--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--timeout

Maximum wait in seconds.

Default value: 3600
--updated

Wait until updated with provisioningState at 'Succeeded'.

Default value: False
--vault-name -v

The name of the backup vault.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.