Is it possible to move a Backup Vault into a VNet?

Question

Is it possible to move a Backup Vault into a VNet?

Qin, Jiang 20

I am using a Backup Vault to back up a storage account.
I want to move this Backup Vault into a VNet so that it cannot be accessed from the public internet. Is this possible? Also, is it necessary to do so?

From my research online, it seems that normally the Backup Vault cannot be accessed directly. Is my understanding correct?

Qin, Jiang 20 Reputation points

2025-06-12T08:10:46.74+00:00

Thank you for your response！

It's true that Recovery Services vaults can be configured with endpoints to control access. However, I couldn't find similar settings for Backup vaults used for backing up storage accounts.

In the case of Backup vaults for storage account backups, is it possible to move them to a VNet to prevent public access?

Accepted answer

1 additional answer

Your answer

Qin, Jiang 20 Reputation points

2025-06-12T08:10:46.74+00:00

Thank you for your response！

It's true that Recovery Services vaults can be configured with endpoints to control access. However, I couldn't find similar settings for Backup vaults used for backing up storage accounts.

In the case of Backup vaults for storage account backups, is it possible to move them to a VNet to prevent public access?

Answer 1

Hello Qin, Jiang,

Apologies for the delay in my response.

If you intend to use the private for the azure backup vault, Currently, private endpoints are not supported for Backup vaults.

please refer to the below doc.

User's image

https://learn.microsoft.com/en-us/azure/backup/private-endpoints-overview#before-you-start

Hence, If you're planning to use private endpoints for secure backup traffic, you'll need to use a Recovery Services vault and ensure it's set up before any backup items are registered.

Please click Upvote if the provided answer is helpful.

Thanks

Answer 2

Deepanshu katara 16,945 MVP Moderator

Hello , Welcome to MS Q&A

It's not necessary to do so for security purposes because the vaults are already isolated and secure. However, if you want to further restrict access, you can use Private Endpoints.

Private Endpoints allows you to back up data securely from servers inside a Virtual Network (VNet) to your Recovery Services vault without exposing your virtual networks to public IPs. This setup is particularly useful for backing up and restoring SQL and SAP HANA databases running inside Azure VMs, as well as for on-premises servers using the MARS agent.

For more detailed information, you can refer to the Azure Backup security overview and Private Endpoints for Azure Backup.

Please let me know if any furthe ques

Kindly accept if helps

Thanks

Deepanshu

Qin, Jiang 20 Reputation points

2025-06-12T08:10:58.6933333+00:00

Thank you for your response！

It's true that Recovery Services vaults can be configured with endpoints to control access. However, I couldn't find similar settings for Backup vaults used for backing up storage accounts.

In the case of Backup vaults for storage account backups, is it possible to move them to a VNet to prevent public access?
Deepanshu katara 16,945 Reputation points MVP Moderator

2025-06-12T11:02:47.13+00:00
you can secure access to Backup vaults (including those used for storage account backups) by configuring private endpoints.

By enabling private endpoints for your Backup vault, all backup and restore traffic is routed privately within your VNet, preventing public access.

This setup ensures that backup data and control plane traffic do not leave your VNet, effectively restricting access to only resources within your private network.
Qin, Jiang 20 Reputation points

2025-06-13T00:00:30.0566667+00:00

Thank you very much for the detailed explanation! If possible, I would greatly appreciate it if you could kindly explain how to configure a private endpoint for a Backup vault via the Azure portal.
Deepanshu katara 16,945 Reputation points MVP Moderator

2025-06-13T11:31:41.0366667+00:00
To configure a private endpoint for a Backup vault via the Azure portal:

Navigate to your Backup vault in the Azure portal.

In the left menu, select Networking.

Under the Private endpoint connections tab, click + Private endpoint.

Fill in the required details (Name, Region, Subscription, Resource group).

Under Resource, confirm the Backup vault is selected.

Under Virtual Network, select the VNet and subnet where you want the private endpoint.

Review and create the private endpoint.

Once created, approve the connection if required.

For step-by-step visuals and more details, see Configure private endpoint for Backup vault.

Pls accept answer if it helps
Qin, Jiang 20 Reputation points

2025-06-16T00:18:14.2+00:00

Thank you very much for your response. However, there doesn't seem to be a "Networking" option in the site menu of the Backup Vault. I believe you might be referring to the configuration method for the Recovery Services Vault endpoint instead. If possible, could you kindly provide guidance on how to configure the endpoint for the Backup Vault?
Qin, Jiang 20 Reputation points

2025-06-18T06:19:13.8266667+00:00

Hello Vinod Pittala
Thank you very much for your detailed explanation!
I fully understand now.
Vinod Pittala 4,500 Reputation points Microsoft External Staff Moderator

2025-06-18T06:30:20.3966667+00:00

You are welcome Qin, Jiang.

Additionally, I have converted the comment into an answer. If you could kindly accept answer and upvote it for the benefit of the community, it would be greatly appreciated and helpful to others.

Thanks

Share via

Is it possible to move a Backup Vault into a VNet?

1 additional answer

Your answer