Best practices for backing up an Azure File Share( 15TB) to the Cold Tier?

Question

Question:

I have a client requirement to back up Azure File Share data and store it in cold storage (Archive or Cold tier) for cost optimization.

• Current environment: Azure File Shares in a GPv2 Premium storage account.
• Backup solution: Azure Backup via Recovery Services Vault.
• Goal: Move older backups to Archive or Cold tier for long-term retention and cost savings.

Questions:

1. Does Azure Backup for Azure Files support Archive or Cold tier in Recovery Services Vault?
2. If not, what is the recommended Microsoft-supported approach to achieve cold storage for Azure File Share data?
3. Can we use Lifecycle Management or AzCopy to move vaulted backups to Archive tier?

What I found so far:

• Azure Files backup supports only Snapshot tier and Vault-Standard tier.
• Archive tier is supported only for Azure VM backups, SQL in Azure VMs, and SAP HANA in Azure VMs.

Client Requirement:

• Full backup of ~15 TB file share data into cold storage as an interim measure.
• Long-term cost optimization for rarely accessed data.

What is the best Microsoft-recommended solution for this scenario?

• Should we use AzCopy to move data to Blob Archive tier and apply Lifecycle Management?
• Or is there any roadmap for Archive tier support for Azure Files in RSV?

Answer 1

Hi Paul

Thank you for reaching out on Microsoft Q&A forum.

Azure Backup for Azure File Shares does not currently support Archive or Cold tier in Recovery Services Vault.

Your findings are correct:

Azure Files backup supports only Snapshot tier and Vault-Standard tier.

Archive tier is supported only for Azure VM backups, SQL in Azure VMs, and SAP HANA in Azure VMs.

Use AzCopy to Move Data to Blob Storage :You can use https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10 to manually move older data from Azure File Shares to Blob Storage configured with the Archive tier.

This can be used as a workaround for long-term retention(back up) and cost savings

It enables use of Archive tier for infrequently accessed data

Lifecycle Management for Blob Storage: Once data is in Blob Storage, you can apply https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-policy-configure to automatically transition blobs from Hot to Cool to Archive tiers based on age.

So for cost optimization: Apply Lifecycle Management to transition blobs to Archive tier

& Full backup of ~15 TB file share data into cold storage-Use AzCopy to move data to Blob Storage

There is no roadmap indicating Archive tier support for Azure File Share backups in RSV from.

Please find the reference links for better understanding:

https://learn.microsoft.com/en-us/azure/backup/azure-file-share-backup-overview?tabs=snapshot

https://learn.microsoft.com/en-us/azure/storage/files/files-redundancy?tabs=azure-portal

If you find this comment helpful, please “up-vote” for the information provided , this can be beneficial to community members.

Kindly let us know if you have any additional questions

Thanks

Answer 2

Hello Paul,

Thank you for your question. Protecting the data in your Azure file shares is critical, and using the native Azure Backup service is the recommended and most integrated approach. It provides a simple, secure, and cloud-native solution without requiring you to manage any additional infrastructure.

Here are the best practices for backing up an Azure file share, centered around using Azure Backup.

1. Use a Centralized Recovery Services Vault

A Recovery Services vault is the cornerstone of Azure Backup. It is a storage entity in Azure that holds your backup data and recovery points.

• Location: For simplicity and to avoid data transfer costs, create the Recovery Services vault in the same region as the storage account containing your file shares.

Centralization: You can use a single vault to manage backups for multiple file shares across different storage accounts, giving you a unified view of your protected data.

2. Implement a Tiered Backup Policy

Azure Backup for file shares uses a combination of local snapshots and vaulted backups. Your backup policy should define the schedule and retention for each tier.

Snapshot Tier: These are point-in-time, read-only copies of your file share stored locally within the same storage account. They are excellent for quick, operational restores, such as recovering from an accidental file deletion. Snapshots are taken according to the schedule you define in your policy.

Vault-Standard Tier: For long-term retention and protection against storage account deletion or disaster, Azure Backup copies the snapshots to the Recovery Services vault. Typically, the last snapshot of the day is transferred to the vault.

Policy Configuration:

Schedule: You can configure up to six snapshot backups per day.

  **Retention:** Define how long you want to keep your daily, weekly, monthly, and yearly recovery points. You can retain backups in the vault for up to 10 years.
  

3. Enable Soft Delete for Enhanced Protection

One of the biggest threats to data is accidental or malicious deletion. Soft delete provides an essential layer of protection.

How it Works: When enabled on your storage account, soft delete protects your file share and its snapshots from being permanently deleted for a configurable retention period. If a share is deleted, it transitions to a soft-deleted state, from which it can be recovered. This is crucial for defending against ransomware attacks that might attempt to delete your backups.

4. Choose the Right Storage Redundancy for Your Vault

The redundancy of your Recovery Services vault determines the durability of your vaulted backups.

Locally-Redundant Storage (LRS): The most cost-effective option, it creates three copies of your data within a single physical location in the primary region. It protects against local hardware failures but not a region-wide disaster.

Geo-Redundant Storage (GRS): The default and recommended option for critical data. It replicates your data to a secondary region, protecting you from a regional outage.

5. Secure Your Backups

Ensure that access to your backup data is properly controlled.

Grant Access: When configuring backups, you must enable the exception to "Allow Azure services on the trusted services list to access this storage account" in your storage account's firewall settings. This allows the Azure Backup service to access your file share to perform the backup [, ].

Use Azure File Sync with Cloud Backups: If you are using Azure File Sync to cache on-premises data, it is a best practice to back up the cloud endpoint (the Azure file share) rather than the on-premises servers. The cloud contains the full copy of your data, whereas the on-premises servers might only have a partial cache.

By following these best practices, you can create a robust, secure, and cost-effective backup strategy for your Azure file shares.

Best Regards,

Jerald Felix