This article is contributed. See the original author and article here.

Azure Backup recently announced the general availability of immutable vaults that offer improved protection for your backup data better against ransomware attacks and other malicious actors. Immutable vaults protect your backups by blocking any operations that could lead to loss of recovery points if misused. Further, you can lock the immutability setting to make it irreversible, which can prevent malicious actors from disabling immutability and deleting backups.

Immutability is generally available for Recovery Services vaults as well as Backup vaults.

How it works

Backup data stored using Azure Backup is not accessible directly and the only way to access or manage this data is through the vault. Immutable vaults further help you by preventing any operations that, if used by malicious actors, could lead to the loss of backups. The Immutable vault setting on your vault enables you to block such operations to ensure that your backup data is protected, even if any malicious actors try to delete them to affect the recoverability of data.

 

The following operations are protected when using immutable vaults:

 

For Recovery Services vaults:

Operation type	Description
Stop protection with delete data	A protected item can’t have its recovery points deleted before their respective expiry date. However, you can still stop protection of the instances while retaining data forever or until their expiry.
Modify backup policy to reduce retention	Any actions that reduce the retention period in a backup policy are disallowed on Immutable vault. However, you can make policy changes that result in the increase of retention. You can also make changes to the schedule of a backup policy.
Change backup policy to reduce retention	Any attempt to replace a backup policy associated with a backup item with another policy with retention lower than the existing one is blocked. However, you can replace a policy with the one that has higher retention.

 

For Backup vaults:

Operation type	Description
Stop protection with delete data	A protected item can’t have its recovery points deleted before their respective expiry date. However, you can still stop protection of the instances while retaining data forever or until their expiry.

 

Enabling immutability and making it irreversible

Enabling a vault to be immutable restricts performing certain operations on your backups. So, Azure Backup provides you an opportunity to ensure all your configurations are as per your requirements before you lock immutability to make it irreversible. Hence, when it comes to immutability your vault can have one of the following states for the setting:

 

State of Immutable vault setting	Description
Disabled	The vault doesn’t have immutability enabled and no operations are blocked.
Enabled	The vault has immutability enabled and doesn’t allow operations that could result in loss of backups. However, the setting can be disabled.
Enabled and locked	The vault has immutability enabled and doesn’t allow operations that could result in loss of backups. As the Immutable vault setting is now locked, it can’t be disabled. Note that immutability locking is irreversible, so ensure that you take a well-informed decision when opting to lock.

 

You can enable immutability and then make it irreversible (or ‘lock’ it) through vault properties.

 

 

Learn more

Check out this article to learn more about immutable vaults for Azure Backup.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.