Share via

Azure SQL Database and Managed Instance backups - immutable?

Wojnar, Peter 11 Reputation points
2021-06-09T19:11:37.74+00:00

This question has been asked before but I'd just like to get current information.

Are Azure SQL Database and Managed Instance backups saved on immutable storage?

If not, is there any way to direct the backups to the Azure immutable blob storage? And even if that were possible would it improve security against things like ransomware attacks, or, is it unnecessary given the current safety and security of the default Azure SQL backup storage location?

Azure Backup
Azure Backup
An Azure backup service that provides built-in management at scale.
1,496 questions
Azure SQL Database

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Alberto Morillo 34,676 Reputation points MVP Volunteer Moderator
    2021-06-09T22:55:40.827+00:00

    Azure SQL Database and Azure SQL Managed Instances automated backups are managed by Azure and their integrity are responsibility of Azure platform. No user has access to them, they are encrypted at rest, no possibility of ransomware attacks affecting them. They are also replicated to other regions for protection.

    In addition, on an ongoing basis, the Azure SQL engineering team automatically tests the restore of automated database backups. (This testing is not currently available in SQL Managed Instance.) Upon point-in-time restore, databases also receive DBCC CHECKDB integrity checks. Any issues found during the integrity check will result in an alert to the engineering team. Furthermore, all database backups are taken with the CHECKSUM option to provide additional backup integrity.

    If the above does not make you satisfied to can implement your own backup schedule and store your bacpac files on Azure Immutable Blog Storage available since September 2018 as documented here. For managed instance you can implement Backup to URL and with Azure SQL you can use Azure Automation to create backups of your data and place those backups on Azure Immutable Blog Storage.

    3 people found this answer helpful.
    0 comments
  2. Mark Freeman 1 Reputation point
    2025-06-30T13:14:54.55+00:00

    @Alberto Morillo This implies that Microsoft will be alerted when the backup file becomes encrypted by ransomware, but does not say anything about Microsoft recovering an original unencrypted version. Can you clarify that process, especially considering that this blog post basically says we have to implement our own backup (with additional storage costs) to achieve this?

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.