Quickstart: Configure vaulted backup for Azure Files using Azure CLI

This quickstart describes how to configure vaulted backup for Azure Files using Azure CLI. The Azure CLI is used to create and manage Azure resources from the command line or in scripts. You can also perform these steps with Azure PowerShell or in the Azure portal.

Azure Backup supports configuring snapshot and vaulted backups for Azure Files in your storage accounts. Vaulted backups offer an offsite solution, storing data in a general v2 storage account to protect against ransomware and malicious admin actions. You can:

• Define backup schedules and retention settings.
• Store backup data in the Recovery Service vault, retaining it for up to 10 years.

Prerequisites

Before you configure vaulted backup for Azure Files, ensure that the following prerequisites are met:

• Use Bash in Azure Cloud Shell. See the Quickstart guide.

• Install Azure CLI to run CLI Commands Locally. For Windows or macOS, use a Docker container. Learn how to use Docker container. To install and upgrade Azure CLI locally, follow these steps:

  1. Sign in using the az login command and follow the instructions on the Terminal. For other sign-in options, See Sign in with Azure CLI.

  2. When prompted, install the Azure CLI extension. See how to use extensions with Azure CLI.

  3. Check the Azure CLI version by using the az version and update if needed with the az upgrade command.

     Note

     The Azure CLI version must be 2.0.18 or higher. Azure Cloud Shell already has the latest version.

• Ensure that File Share is in a supported storage account type. See the Azure Files backup support matrix.

• Allow Azure services on the trusted services list in the Firewall settings to access the storage account, if access is restricted. Learn how to grant an exception.

• Use an existing Recovery Services vault. If you don't have the vault, create one.

• Create a Backup policy for the backup operation.

Configure backup

To configure vaulted backup for Azure Files, use the az backup protection enable-for-azurefileshare command.

The following example command enables backup for the afs0 File Share in the afsbugbash0 storage account using the schedule 1 backup policy:

az backup protection enable-for-azurefileshare -p "vaultpol" --resource-group myResourceGroup --vault-name myRecoveryServicesVault  --storage-account "afsbugbash0" --azure-file-share "afs0" 
output
(azcli) C:\Users\testuser\Downloads\CLIForAFS\azure-cli>az backup protection enable-for-azurefileshare -p "snappol" --resource-group "myResourceGroup " --vault-name "afsbugbashvault" --storage-account "afsbugbash0" --azure-file-share "afs0"
{
  "eTag": null,
  "id": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup /providers/Microsoft.RecoveryServices/vaults/ myRecoveryServicesVault  /backupFabrics/Azure/protectionContainers/StorageContainer;storage;myResourceGroup ;afsbugbash0/protectedItems/AzureFileShare;9031e290ca28baa9cb64903a30247d2b9ff3ca143a5e1a37c7afec6b2ff1a2e4",
  "location": null,
  "name": "AzureFileShare;9031e290ca28baa9cb64903a30247d2b9ff3ca143a5e1a37c7afec6b2ff1a2e4",
  "properties": {
    "backupManagementType": "AzureStorage",
    "backupSetName": null,
    "containerName": "StorageContainer;storage;myResourceGroup ;afsbugbash0",
    "createMode": null,
    "deferredDeleteTimeInUtc": null,
    "deferredDeleteTimeRemaining": null,
    "extendedInfo": null,
    "friendlyName": "afs0",
    "isArchiveEnabled": false,
    "isDeferredDeleteScheduleUpcoming": null,
    "isRehydrate": null,
    "isScheduledForDeferredDelete": null,
    "kpisHealths": null,
    "lastBackupStatus": "Completed",
    "lastBackupTime": "2025-01-16T23:02:10.801858+00:00",
    "lastRecoveryPoint": null,
    "policyId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup/providers/Microsoft.RecoveryServices/vaults/ myRecoveryServicesVault  /backupPolicies/vaultpol",
    "policyName": null,
    "protectedItemType": "AzureFileShareProtectedItem",
    "protectionState": "Protected",
    "protectionStatus": "Healthy",
    "resourceGuardOperationRequests": null,
    "softDeleteRetentionPeriod": 0,
    "softDeleteRetentionPeriodInDays": null,
    "sourceResourceId": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup /providers/Microsoft.storage/storageAccounts/afsbugbash0",
    "vaultId": "https://management.azure.com/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup /providers/Microsoft.RecoveryServices/vaults/afsbugbashvault",
    "workloadType": "AzureFileShare"
  },
  "resourceGroup": "myResourceGroup ",
  "tags": null,
  "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems"
}

Next steps

• Restore Azure Files using CLI.
• Restore Azure Files using Azure portal, Azure PowerShell, REST API.
• Manage Azure Files backups using Azure portal, Azure PowerShell, Azure CLI, REST API.