Backup Security

Question

Securing the backup vault can be with different approaches but what if the Global administrator got compromised . Is there any approach that can disable access to the backup vault even for global admin. Like giving Microsoft itself the ownership of the vault and for enabling access to it must contact Microsoft ?

Answer 1

Hi, Attya

You can configure Resource Guard, on your Azure Recovery Vault; Resource Guard adds PIM (Privileged Identity Management) in front of Backup operations, such as Delete, etc. You can add approvals as well. Forcing MFA to occur, and if needed multiple users to approve any change.

You can also adjust the vault to be immutable. Making the vault immutable, will prevent anything from being deleted, before the Azure policy, and retention period for that backup expired. Keep in mind, this can cause unforeseen effects, like cost growout, etc, but you can lock the immutability to prevent any changes, even from a person with GA rights.

Answer 2

Hi Attya there are a few approaches that can disable access to the backup vault even for global admin

1. Implement Role-Based Access Control (RBAC) and assign minimum required permissions.
2. Enable Multi-Factor Authentication (MFA) for all user accounts.
3. Monitor and audit activities in the backup vault.
4. Implement Just-in-Time Access (JIT) and Azure AD Privileged Identity Management (PIM) to limit elevated privileges.
5. Regularly review and update security practices.

If you find the answer useful kindly accept.