Resource Guards - Put

Service:

Data Protection

API Version:

2026-03-01

Creates or updates a ResourceGuard resource belonging to a resource group.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DataProtection/resourceGuards/{resourceGuardsName}?api-version=2026-03-01

URI Parameters

Name	In	Required	Type	Description
resourceGroupName	path	True	string minLength: 1 maxLength: 90	The name of the resource group. The name is case insensitive.
resourceGuardsName	path	True	string	The name of ResourceGuard
subscriptionId	path	True	string (uuid)	The ID of the target subscription. The value must be an UUID.
api-version	query	True	string minLength: 1	The API version to use for this operation.

Request Body

Name	Required	Type	Description
location	True	string	The geo-location where the resource lives
eTag		string	Optional ETag.
properties		ResourceGuard	ResourceGuardResource properties
tags		object	Resource tags.

Responses

Name	Type	Description
200 OK	ResourceGuardResource	Resource 'ResourceGuardResource' update operation succeeded
201 Created	ResourceGuardResource	Resource 'ResourceGuardResource' create operation succeeded
Other Status Codes	CloudError	An unexpected error response.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Create ResourceGuard

Sample request

HTTP

PUT https://management.azure.com/subscriptions/0b352192-dcac-4cc7-992e-a96190ccc68c/resourceGroups/SampleResourceGroup/providers/Microsoft.DataProtection/resourceGuards/swaggerExample?api-version=2026-03-01

{
  "location": "WestUS",
  "tags": {
    "key1": "val1"
  }
}

Java

import java.util.HashMap;
import java.util.Map;

/**
 * Samples for ResourceGuards Put.
 */
public final class Main {
    /*
     * x-ms-original-file: 2026-03-01/ResourceGuardCRUD/PutResourceGuard.json
     */
    /**
     * Sample code: Create ResourceGuard.
     * 
     * @param manager Entry point to DataProtectionManager.
     */
    public static void createResourceGuard(com.azure.resourcemanager.dataprotection.DataProtectionManager manager) {
        manager.resourceGuards().define("swaggerExample").withRegion("WestUS")
            .withExistingResourceGroup("SampleResourceGroup").withTags(mapOf("key1", "fakeTokenPlaceholder")).create();
    }

    // Use "Map.of" if available
    @SuppressWarnings("unchecked")
    private static <T> Map<String, T> mapOf(Object... inputs) {
        Map<String, T> map = new HashMap<>();
        for (int i = 0; i < inputs.length; i += 2) {
            String key = (String) inputs[i];
            T value = (T) inputs[i + 1];
            map.put(key, value);
        }
        return map;
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Python

from azure.identity import DefaultAzureCredential

from azure.mgmt.dataprotection import DataProtectionMgmtClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-dataprotection
# USAGE
    python put_resource_guard.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = DataProtectionMgmtClient(
        credential=DefaultAzureCredential(),
        subscription_id="SUBSCRIPTION_ID",
    )

    response = client.resource_guards.put(
        resource_group_name="SampleResourceGroup",
        resource_guards_name="swaggerExample",
        parameters={"location": "WestUS", "tags": {"key1": "val1"}},
    )
    print(response)


# x-ms-original-file: 2026-03-01/ResourceGuardCRUD/PutResourceGuard.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Go

package armdataprotection_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/dataprotection/armdataprotection/v4"
)

// Generated from example definition: 2026-03-01/ResourceGuardCRUD/PutResourceGuard.json
func ExampleResourceGuardsClient_Put() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armdataprotection.NewClientFactory("0b352192-dcac-4cc7-992e-a96190ccc68c", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewResourceGuardsClient().Put(ctx, "SampleResourceGroup", "swaggerExample", armdataprotection.ResourceGuardResource{
		Location: to.Ptr("WestUS"),
		Tags: map[string]*string{
			"key1": to.Ptr("val1"),
		},
	}, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armdataprotection.ResourceGuardsClientPutResponse{
	// 	ResourceGuardResource: &armdataprotection.ResourceGuardResource{
	// 		Name: to.Ptr("VaultGuardTestNew"),
	// 		Type: to.Ptr("Microsoft.DataProtection/resourceGuards"),
	// 		ID: to.Ptr("/subscriptions/c999d45b-944f-418c-a0d8-c3fcfd1802c8/resourceGroups/vaultguardRGNew/providers/Microsoft.DataProtection/resourceGuards/VaultGuardTestNew"),
	// 		Location: to.Ptr("eastus"),
	// 		Properties: &armdataprotection.ResourceGuard{
	// 			Description: to.Ptr("Please take JIT access before performing any of the critical operation"),
	// 			AllowAutoApprovals: to.Ptr(true),
	// 			ProvisioningState: to.Ptr(armdataprotection.ProvisioningStateSucceeded),
	// 			ResourceGuardOperations: []*armdataprotection.ResourceGuardOperation{
	// 				{
	// 					RequestResourceType: to.Ptr("Microsoft.DataProtection/resourceGuards/deleteResourceGuardProxyRequests"),
	// 					VaultCriticalOperation: to.Ptr("Microsoft.RecoveryServices/vaults/backupResourceGuardProxies/delete"),
	// 				},
	// 				{
	// 					RequestResourceType: to.Ptr("Microsoft.DataProtection/resourceGuards/disableSoftDeleteRequests"),
	// 					VaultCriticalOperation: to.Ptr("Microsoft.RecoveryServices/vaults/backupconfig/write"),
	// 				},
	// 			},
	// 			VaultCriticalOperationExclusionList: []*string{
	// 			},
	// 		},
	// 		Tags: map[string]*string{
	// 			"TestKey": to.Ptr("TestValue"),
	// 		},
	// 	},
	// }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

JavaScript

const { DataProtectionClient } = require("@azure/arm-dataprotection");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to creates or updates a ResourceGuard resource belonging to a resource group.
 *
 * @summary creates or updates a ResourceGuard resource belonging to a resource group.
 * x-ms-original-file: 2026-03-01/ResourceGuardCRUD/PutResourceGuard.json
 */
async function createResourceGuard() {
  const credential = new DefaultAzureCredential();
  const subscriptionId = "0b352192-dcac-4cc7-992e-a96190ccc68c";
  const client = new DataProtectionClient(credential, subscriptionId);
  const result = await client.resourceGuards.put("SampleResourceGroup", "swaggerExample", {
    location: "WestUS",
    tags: { key1: "val1" },
  });
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:

200

{
  "name": "VaultGuardTestNew",
  "type": "Microsoft.DataProtection/resourceGuards",
  "id": "/subscriptions/c999d45b-944f-418c-a0d8-c3fcfd1802c8/resourceGroups/vaultguardRGNew/providers/Microsoft.DataProtection/resourceGuards/VaultGuardTestNew",
  "location": "eastus",
  "properties": {
    "description": "Please take JIT access before performing any of the critical operation",
    "allowAutoApprovals": true,
    "provisioningState": "Succeeded",
    "resourceGuardOperations": [
      {
        "requestResourceType": "Microsoft.DataProtection/resourceGuards/deleteResourceGuardProxyRequests",
        "vaultCriticalOperation": "Microsoft.RecoveryServices/vaults/backupResourceGuardProxies/delete"
      },
      {
        "requestResourceType": "Microsoft.DataProtection/resourceGuards/disableSoftDeleteRequests",
        "vaultCriticalOperation": "Microsoft.RecoveryServices/vaults/backupconfig/write"
      }
    ],
    "vaultCriticalOperationExclusionList": []
  },
  "tags": {
    "TestKey": "TestValue"
  }
}

Status code:

201

{
  "name": "VaultGuardTestNew",
  "type": "Microsoft.DataProtection/resourceGuards",
  "id": "/subscriptions/c999d45b-944f-418c-a0d8-c3fcfd1802c8/resourceGroups/vaultguardRGNew/providers/Microsoft.DataProtection/resourceGuards/VaultGuardTestNew",
  "location": "eastus",
  "properties": {
    "description": "Please take JIT access before performing any of the critical operation",
    "allowAutoApprovals": true,
    "provisioningState": "Succeeded",
    "resourceGuardOperations": [
      {
        "requestResourceType": "Microsoft.DataProtection/resourceGuards/deleteResourceGuardProxyRequests",
        "vaultCriticalOperation": "Microsoft.RecoveryServices/vaults/backupResourceGuardProxies/delete"
      },
      {
        "requestResourceType": "Microsoft.DataProtection/resourceGuards/disableSoftDeleteRequests",
        "vaultCriticalOperation": "Microsoft.RecoveryServices/vaults/backupconfig/write"
      }
    ],
    "vaultCriticalOperationExclusionList": []
  },
  "tags": {
    "TestKey": "TestValue"
  }
}

Definitions

Name	Description
CloudError	An error response from Azure Backup.
createdByType	The type of identity that created the resource.
Error	The resource management error response.
ErrorAdditionalInfo	The resource management error additional info.
ProvisioningState	Provisioning state of the BackupVault resource
ResourceGuard
ResourceGuardOperation	This class contains all the details about a critical operation.
ResourceGuardResource	Concrete tracked resource types can be created by aliasing this type using a specific property type.
systemData	Metadata pertaining to creation and last modification of the resource.

CloudError

Object

An error response from Azure Backup.

Name	Type	Description
error	Error	The resource management error response.

createdByType

Enumeration

The type of identity that created the resource.

Value	Description
User
Application
ManagedIdentity
Key

Error

Object

The resource management error response.

Name	Type	Description
additionalInfo	ErrorAdditionalInfo[]	The error additional info.
code	string	The error code.
details	Error[]	The error details.
message	string	The error message.
target	string	The error target.

ErrorAdditionalInfo

Object

The resource management error additional info.

Name	Type	Description
info	object	The additional info.
type	string	The additional info type.

ProvisioningState

Enumeration

Provisioning state of the BackupVault resource

Value	Description
Failed
Provisioning
Succeeded
Unknown
Updating

ResourceGuard

Object

Name	Type	Description
allowAutoApprovals	boolean	This flag indicates whether auto approval is allowed or not.
description	string	Description about the pre-req steps to perform all the critical operations.
provisioningState	ProvisioningState	Provisioning state of the BackupVault resource
resourceGuardOperations	ResourceGuardOperation[]	{readonly} List of operation details those are protected by the ResourceGuard resource
vaultCriticalOperationExclusionList	string[]	List of critical operations which are not protected by this resourceGuard

ResourceGuardOperation

Object

This class contains all the details about a critical operation.

Name	Type	Description
requestResourceType	string	Type of resource request.
vaultCriticalOperation	string	Name of the critical operation.

ResourceGuardResource

Object

Concrete tracked resource types can be created by aliasing this type using a specific property type.

Name	Type	Description
eTag	string	Optional ETag.
id	string (arm-id)	Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
location	string	The geo-location where the resource lives
name	string	The name of the resource
properties	ResourceGuard	ResourceGuardResource properties
systemData	systemData	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Resource tags.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

systemData

Object

Metadata pertaining to creation and last modification of the resource.

Name	Type	Description
createdAt	string (date-time)	The timestamp of resource creation (UTC).
createdBy	string	The identity that created the resource.
createdByType	createdByType	The type of identity that created the resource.
lastModifiedAt	string (date-time)	The timestamp of resource last modification (UTC)
lastModifiedBy	string	The identity that last modified the resource.
lastModifiedByType	createdByType	The type of identity that last modified the resource.