Resource Guard - Deleted mapped RG and add a new one

Question

Resource Guard - Deleted mapped RG and add a new one

Markus Quint 20

Hello,

I created a Backup vault in a subscription SUBtest01.

I also added a Resource Guard in a different Tenant and subscription SUBtest02.

After that i added the resource guard to the vault to protect the backups.

Everthing works great.

But now my problem:

I deleted the Resource Guard in SUBtest02 without disableing it on the Vault in SUBtest01.

So now I can't delete any backups for example and get the message that the Resoucre guard is no longer available.

So far so good.

But now I used a 3rd Tenant - SUBtest03 and created a new Resource guard in a different Subscription.

I was able to add the complete new Resource Guard to my vault in SUBtest01.

After that I was able to delete the backups in the vault SUBtest01.

Like I read at Microsoft: that shouldn't work.

"Since the Resource Guard is gone, there's no way to approve protected operations. The vault is effectively stuck in a protected state.

Manual intervention is required: You will need to open a support ticket with Microsoft to:
- Remove the reference to the deleted Resource Guard.
- Restore access to protected operations on the vault.
No automatic cleanup: Azure does not automatically detect or remove the Resource Guard reference, even if it no longer exists in the other tenant

"

Accepted answer

0 additional answers

Your answer

Answer 1

Stanislav Zhelyazkov 28,596 MVP Volunteer Moderator

Hi,

You can point me to the exact documentation where that is stated but overall is true and what you have done is also true. Although specific operations are protected by the resource guard configuring settings on the vault are not protected by resource guard and with account that has permissions can update those settings. So in your case you haven't removed the resource guard but you have replaced it with another one. If you have tried to remove the resource guard that would not be possible most likely and you will get an error and in such case you could contact Microsoft to remove the resource guard. From my perspective this is fine and it should be the way it should be working and it is nice workaround to avoid dealing with Microsoft support in rare cases like these.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Markus Quint 20 Reputation points

2025-07-01T10:13:12.3133333+00:00

I got that Information from Copilot. But yeah I also cant find the text in the articel :-)

Another Question would be:

What happend when I have a geo Redundant vault for example in "Germany West Central" and the side goes down. Normaly the vault would be accessible in "Germany North".

But because the Resource Guard has to be in the same location it will be also in Germany West Central and also down.

So I will not be able to do some restores in the event of a catastrophic failure in the primary region?

Thanks a lot!

Regards Markus
Stanislav Zhelyazkov 28,596 Reputation points MVP Volunteer Moderator

2025-07-01T10:58:04.36+00:00

well Copilot can bend the truth. I think the mentioned statement points to this document About Multi-user authorization using Resource Guard but if you open the page there is not such document. So may be even resource guard can be removed even when the referenced guard no longer exists. Do not trust Copilot blindly. On the second question you have that is most likely true. However only Azure support can answer if that is the case. Note that by default the vault is cross region redundant:

"When an entire Azure region or datacenter experiences downtime, your vaults continue to be accessible and you'll still be able to see your backup items. However, unless you deploy for regional redundancy, the underlying backup data isn't accessible to you for performing a restore operation."

Cross-region disaster recovery and business continuity.

It is that way even if the storage for the backup is not GRS. So may be resource guards have the same technology that in case of region outage resource guard will be available in via the paired region.
Ashok Gandhi Kotnana 10,430 Reputation points Microsoft External Staff Moderator

2025-07-02T18:04:17.4233333+00:00

Hi @Markus Quint ,

Just want to check if the above answer worked for you or else please let us know if any help, we are always here to help whenever you need us.

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others
Markus Quint 20 Reputation points

2025-07-03T14:10:46.9533333+00:00

So what happen exactly when I have enable the backups with GRS?

"The backups in the secondary region become accessible only when Microsoft declares an outage in the primary region."

Is the Resource Guard also accessible?

How does that excatly work?

Thanks

Regards Markus
Stanislav Zhelyazkov 28,596 Reputation points MVP Volunteer Moderator

2025-07-03T16:35:15.5866667+00:00

For the resource guard I do not know as there is no official information on that. Yes, Backup vaults have this regional redundancy that is initiated by Azure. It cannot be initiated by your on your own.

Share via

Resource Guard - Deleted mapped RG and add a new one

0 additional answers

Your answer