Azure SQL Database and Managed Instance backups - immutable?

Question

This question has been asked before but I'd just like to get current information.

Are Azure SQL Database and Managed Instance backups saved on immutable storage?

If not, is there any way to direct the backups to the Azure immutable blob storage? And even if that were possible would it improve security against things like ransomware attacks, or, is it unnecessary given the current safety and security of the default Azure SQL backup storage location?

Answer 1

Azure SQL Database and Azure SQL Managed Instances automated backups are managed by Azure and their integrity are responsibility of Azure platform. No user has access to them, they are encrypted at rest, no possibility of ransomware attacks affecting them. They are also replicated to other regions for protection.

In addition, on an ongoing basis, the Azure SQL engineering team automatically tests the restore of automated database backups. (This testing is not currently available in SQL Managed Instance.) Upon point-in-time restore, databases also receive DBCC CHECKDB integrity checks. Any issues found during the integrity check will result in an alert to the engineering team. Furthermore, all database backups are taken with the CHECKSUM option to provide additional backup integrity.

If the above does not make you satisfied to can implement your own backup schedule and store your bacpac files on Azure Immutable Blog Storage available since September 2018 as documented here. For managed instance you can implement Backup to URL and with Azure SQL you can use Azure Automation to create backups of your data and place those backups on Azure Immutable Blog Storage.