Azure Backup supports backing up all the disks (operating system and data) in a VM using the virtual machine backup solution. The selective disk backup and restore functionality helps you to back up a subset of the data disks in a VM. This provides an efficient and cost-effective solution for your backup and restores needs.
In this article, we will show you how to restore selective disk (OS and Data) for Azure virtual machines with Azure Backup in Azure CLI and Azure PowerShell.
Table of Contents
Introduction
Azure Backup ensures your backup data is stored securely by leveraging the built-in security capabilities of the Azure platform role-based access control (RBAC) and encryption. In addition, with the new capabilities for soft-delete, Azure Backup protects against any accidental and malicious attempts for deleting your backups.
With a powerful architecture built into Azure, Azure Backup does all this for you in a simple, secure, and cost-effective manner without needing you to worry about anything at all.
You are in a scenario where you are protecting a large VM, and you want to restore only the OS disk or a subset of the data disks and don’t want to restore the rest of the disks attached to a VM to minimize restore time. This is a common scenario when your OS or data disk is corrupted and the virtual machine is not booting anymore.
With the OS Disk Swap capability for virtual machines, it becomes very easy to restore a previous backup of the OS Disk or swap out the OS Disk for VM troubleshooting without having to delete the VM.
As a side note, you can also back up selective disks for Azure VMs. Suppose you have critical data to be backed up in only one disk, or a subset of the disks and don’t want to back up the rest of the disks attached to a VM to minimize the backup storage costs. The OS disk is by default added to the VM backup and can’t be excluded, you can only exclude data disks.
At the time of this writing, the ability to configure selective disk backup through the Azure Portal is limited to the Backup OS Disk as the only option, so you can configure the backup of your Azure VM with OS disk, and exclude all the data disks attached to it. However, using PowerShell or Azure CLI, you can configure selective disk backup and restore the Azure VM by including or excluding data disks using their LUN numbers (more on this in the next section).
Azure Backup now offers an RPO (Recovery Point Objective) of 4 hours for Azure VMs, allowing for faster and more reliable backup and restore processes. The Instant Restore Retention policy enhances backup by offering instant restore retention with a default of seven days and a maximum of 30 days.
Prerequisites
To follow this article, you need to have the following:
1) An Azure subscription. If you don’t have an Azure subscription, you can create a free one here.
2) Azure Resource Group (RG).
3) Azure Recovery Services Vault. Please check the following quick start guide to create and configure a Recovery Services vault.
4) At least one Azure virtual machine is deployed in the desired Resource Group. Please check the following quick start guide to create a Linux or Windows virtual machine.
5) The VM should be protected using Azure Backup. Please check the following step-by-step guide to automate the backup for Azure VMs.
6) You need Azure CLI version 2.0.80 or higher, at the time of this writing, we are using version 2.29.0. You can check the CLI version on your machine and upgrade its version with the following commands:
# Check Azure CLI version
az --version
# Upgrade Azure CLI
az upgrade7) If you prefer to use the Azure PowerShell, then make sure you are using the Az RecoveryServices version 3.7.0 or higher. At the time of this writing, we are using version 4.7.0.
You can use the following PowerShell command to check and update the Az RecoveryServices module locally on your machine which is part of the Az PowerShell module.
# Make sure you have the latest version of PowerShellGet installed
Install-Module -Name PowerShellGet -Force
# Check Az Recovery Services PowerShell version
(Get-Module -Name Az.RecoveryServices -ListAvailable)[0].Version
# Install and update to the latest Az Recovery Service PowerShell module
Install-Module -Name Az.RecoveryServices -AllowClobber -ForceYou can skip points 6 and 7 above if you prefer to use the Azure Cloud Shell instead.
Update disk backup settings for existing VMs
Before you can start restoring an individual disk for the Azure virtual machine, you need to be aware of the most important and confusing point below.
Please note that by default, Azure VM backup backs up all disks. You can selectively backup relevant or all disks by using the -ExclusionDisksList or -InclusionDisksList parameters during the enable backup operation.
The option to selectively restore individual (OS/Data) disks is available only if you have selectively backed them up. In other words, if you don’t enable selective backup for the virtual machine at the beginning, then you cannot restore an individual disk, if you attempt to restore the OS disk as an example, you will see that all disks including data disks will be restored.
Azure CLI
To modify and update the protection for existing backed-up VMs without breaking the protection to include or exclude disks, you can use the following Azure CLI commands:
# Sign in to Azure -> Skip if you are using the Cloud Shell
az login
# Set the Azure context for the desired subscription where your virtual machine and vault are deployed
az account set --subscription "xxxx-xxxx-xxxx-xxxx"
# Set the required variables
$resourceGroupName="<ResourceGroupNameForTheVaultHere>"
$recoveryServicesVaultName="<RecoveryServicesVaultNameHere>"
$virtualMachineName="<VMNameHere>"
# Update backup protection for existing Azure VM to Include list of disks E.g --diskslist 0 1 2
# The parameter --diskslist {LUN number(s) of disks separated by space}
az backup protection update-for-vm --resource-group $resourceGroupName --vault-name $recoveryServicesVaultName --container-name $virtualMachineName --item-name $virtualMachineName --disk-list-setting include --diskslist 0 1 2
# Update backup protection for existing Azure VM to Exclude list of disks
# The parameter --diskslist {LUN number(s) of disks separated by space} E.g --diskslist 1 2
az backup protection update-for-vm --resource-group $resourceGroupName --vault-name $recoveryServicesVaultName --container-name $virtualMachineName --item-name $virtualMachineName --disk-list-setting exclude --diskslist 1 2In this example, I have excluded data disk LUN 0 from the backup as shown in the figure below.
> For more information, please check the following document to enable and update disk backup for Azure VM with Azure CLI.
PowerShell
To modify and update the protection for existing backed-up VMs without breaking the protection to include or exclude disks, you can use the following PowerShell commands:
# Sign in to Azure -> Skip if you are using the Cloud Shell
Login-AzAccount
# Set the Azure context for the desired subscription
Set-AzContext -Subscription "xxxx-xxxx-xxxx-xxxx"
# Set the required variables
$resourceGroupName="<ResourceGroupNameForTheVaultHere>"
$recoveryServicesVaultName="<RecoveryServicesVaultNameHere>"
$virtualMachineName="<VMNameHere>"
# Get the recovery services vault object
$vault = Get-AzRecoveryServicesVault -ResourceGroupName $resourceGroupName -Name $recoveryServicesVaultName
# Set the recovery services vault context
Set-AzRecoveryServicesVaultContext -Vault $vault
# Get the backup item for the virtual machine based on workload type "AzureVM", and store it in the $backupItem variable
$backupItem = Get-AzRecoveryServicesBackupItem -BackupManagementType "AzureVM" -WorkloadType "AzureVM" -VaultId $vault.ID | Where-Object {$_.Name -like "*$virtualMachineName*"}
# Update backup protection for existing Azure VM to Include list of disks E.g -InclusionDisksList 2,3
# The parameter -InclusionDisksList [LUN number(s) of disks with comma separated and without a space]
Enable-AzRecoveryServicesBackupProtection -Item $backupItem -InclusionDisksList 2,3 -VaultId $Vault.ID
# Update backup protection for existing Azure VM to Exclude list of disks E.g -ExclusionDisksList 0,1
# The parameter -ExclusionDisksList [LUN number(s) of disks with comma separated and without a space]
Enable-AzRecoveryServicesBackupProtection -Item $backupItem -ExclusionDisksList 0,1 -VaultId $Vault.ID> For more information, please check the following document to enable and update disk backup for Azure VM with Azure PowerShell.
Assuming you have all the prerequisites in place, take now the following steps.
Restore OS Disk for Azure VM
In this section, I will show you how to restore the OS disk only for Azure virtual machines. You can choose between PowerShell or the Azure CLI.
Open Windows Terminal or use the Azure Cloud Shell at https://shell.azure.com and run the following commands.
First, we need to get all the existing recovery points available for the virtual machine.
Azure CLI
# Sign in to Azure -> Skip if you are using the Cloud Shell
az login
# Set the Azure context for the desired subscription where your virtual machine and vault are deployed
az account set --subscription "xxxx-xxxx-xxxx-xxxx"
# Set the required variables
$resourceGroupName="<ResourceGroupNameForTheVaultHere>"
$recoveryServicesVaultName="<RecoveryServicesVaultNameHere>"
$virtualMachineName="<VMNameHere>"
# Get the list of all existing recovery points available with their name, date/time, OS, Recovery Point Type, and Instant Recovery Point Status
az backup recoverypoint list --resource-group $resourceGroupName --vault-name $recoveryServicesVaultName --container-name $virtualMachineName --item-name $virtualMachineName --query "[].{RPName:name,DateTime:properties.recoveryPointTime,OS:properties.osType,RecoveryPoint:properties.recoveryPointTierDetails[0].type,RPStatus:properties.recoveryPointTierDetails[0].status}" --backup-management-type AzureIaasVM --output table
If the Instant Recovery Points Status is marked as ‘Valid‘ as shown in the figure below, this means that you can recover instantly. This eliminates the wait time for snapshots to copy to the vault before a restore can be triggered. With the instant recovery point, the snapshots taken as a part of the backup job are stored along with the disk and are available for recovery instantly.
However, if the Instant Recovery Points Status is marked as ‘Deleted‘, this means that for those recovery points, you want to wait the time for snapshots to copy to the vault before a restore can be triggered. In this example, I have two instant recovery points, and the rest are stored (hardened) in the standard vault.
To get only the most recent recovery point, you can use the following CLI command instead. In the following example, the object at index 0 is returned (most recent), you can update the index number to select a different recovery point if needed.
# Get the most recent recovery point available with the name, date/time, OS, Recovery Point Type, and Instant Recovery Point Status
az backup recoverypoint list --resource-group $resourceGroupName --vault-name $recoveryServicesVaultName --container-name $virtualMachineName --item-name $virtualMachineName --query "[0].{Name:name,DateTime:properties.recoveryPointTime,OS:properties.osType,RecoveryPoint:properties.recoveryPointTierDetails[0].type,RPStatus:properties.recoveryPointTierDetails[0].status}" --backup-management-type AzureIaasVM --output table
In this example, I want to restore from the most recent backup. We need the recovery point name to do so. I’ll update the command to place the recovery point into a variable. Instead of using table output, we need to use tabbed separated values (tsv). This returns only the recovery point name.
# Get the most recent recovery point available and store the recovery point name into a variable
$rpname=$(az backup recoverypoint list --resource-group $resourceGroupName --vault-name $recoveryServicesVaultName --container-name $virtualMachineName --item-name $virtualMachineName --query [0].name --backup-management-type AzureIaasVM --output tsv)
If you want to see more details of a particular recovery point. You can run the following CLI command:
# Shows details of a particular recovery point
az backup recoverypoint show --container-name $virtualMachineName --backup-management-type AzureIaasVM --item-name $virtualMachineName --name $rpname --resource-group $resourceGroupName --vault-name $recoveryServicesVaultNameNow we have the recovery point name, we can restore the OS disk by adding the flag “–restore-only-osdisk” set to true.
# Set the required variables
$resourceGroupName="<ResourceGroupNameForTheVaultHere>"
$recoveryServicesVaultName="<RecoveryServicesVaultNameHere>"
$virtualMachineName="<VMNameHere>"
$targetResourceGroup="<TargetResourceGroupNameForStorageAccountHere>"
# If the storage account lives in a different resource group than the recovery services vault, then you need to use the Resource ID for the storage account
# E.g. /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountNameHere}
$storageAccountName="<StorageAccountNameHere/ResourceID>"
# Restore only the OS Disk with Azure CLI
az backup restore restore-disks --resource-group $resourceGroupName --vault-name $recoveryServicesVaultName --container-name $virtualMachineName --item-name $virtualMachineName --rp-name $rpname --target-resource-group $targetResourceGroup --storage-account $storageAccountName --restore-only-osdisk true
The instant recovery point restores will take around 1 minute to complete despite the disk size of your virtual machine. The instant restore backup capability is super fast.
Once the restore is completed, browse to the resource group where the virtual machine is deployed. You will see the OS disk name followed by the date of the restore as shown in the figure below:
If you open the Backup jobs blade under Monitoring in the Recovery Services vault from the Azure Portal and look for the Restore job operation details, you will see that only the OS Disk was restored as shown in the figure below.
Next, you need to deallocate/stop your virtual machine and then swap the OS disk as shown in the figure below.
PowerShell
Here is the PowerShell version for the same which is longer than Azure CLI. I prefer to use Azure CLI to manage selective backup and restore activities.
# Sign in to Azure -> Skip if you are using the Cloud Shell
Login-AzAccount
# Set the Azure context for the desired subscription
Set-AzContext -Subscription "xxxx-xxxx-xxxx-xxxx"
# Set the required variables
$resourceGroupName="<ResourceGroupNameForTheVaultHere>"
$recoveryServicesVaultName="<RecoveryServicesVaultNameHere>"
$virtualMachineName="<VMNameHere>"
# Get the recovery services vault object
$vault = Get-AzRecoveryServicesVault -ResourceGroupName $resourceGroupName -Name $recoveryServicesVaultName
# Set the recovery services vault context
Set-AzRecoveryServicesVaultContext -Vault $vault
# Get the backup item for the virtual machine based on workload type "AzureVM", and store it in the $backupItem variable
$backupItem = Get-AzRecoveryServicesBackupItem -BackupManagementType "AzureVM" -WorkloadType "AzureVM" -VaultId $vault.ID | Where-Object {$_.Name -like "*$virtualMachineName*"}
# Last, get the list of all existing recovery points available with their IDs, date/time, Recovery Point Type, and Recovery Point Tier
Get-AzRecoveryServicesBackupRecoveryPoint -Item $backupItem -VaultId $vault.ID | FT RecoveryPointId, RecoveryPointTime, RecoveryPointType, RecoveryPointTier -AutoSize
As noted earlier, if the Recovery Point Tier is marked as ‘SnapshotAndVaultStandard‘ as shown in the figure below, this means that you can recover instantly. This eliminates the wait time for snapshots to copy to the vault before a restore can be triggered. With the instant recovery point, the snapshots taken as a part of the backup job are stored along with the disk and are available for recovery instantly.
However, if the Recovery Point Tier is marked as ‘VaultStandard‘, this means that for those recovery points, you want to wait time for snapshots to copy to the vault which might take a lot of time depending on the size of the disk before a restore can be triggered. In this example, I have two instant recovery points, and the rest are stored (hardened) in the standard vault.
In this example, I want to restore from the most recent backup. We need the recovery point Id to do so. I’ll update the command to place the recovery point details into a variable called $rp. Instead of using format table output, we need to use the select object without selecting any property. This returns the entire recovery point details that I want to restore.
# Get the most recent recovery point available and store it into a variable
$rp=(Get-AzRecoveryServicesBackupRecoveryPoint -Item $backupItem -VaultId $vault.ID)[0]
Now we have the recovery point details, we can restore the OS disk by using the parameter -RestoreOnlyOSDisk.
# Set the required variables
$resourceGroupName="<ResourceGroupNameForTheVaultHere>"
$recoveryServicesVaultName="<RecoveryServicesVaultNameHere>"
$virtualMachineName="<VMNameHere>"
$targetResourceGroup="<TargetResourceGroupNameForStorageAccountHere>"
# Target storage account name and resource group to use during the staging process
$storageAccountName="<StorageAccountNameHere>"
$storageAccountRG="<StorageAccountResourceGroupNameHere>"
# Restore only the OS Disk with Azure PowerShell
Restore-AzRecoveryServicesBackupItem -RecoveryPoint $rp -StorageAccountName $storageAccountName -StorageAccountResourceGroupName $storageAccountRG -TargetResourceGroupName $targetResourceGroup -VaultId $Vault.ID -RestoreOnlyOSDiskPlease do not specify the storage account resource ID in the script above if you prefer to use Azure PowerShell, you need to set the target storage account name and resource group, otherwise, you will end up with an inconsistent error message: Restore-AzRecoveryServicesBackupItem: Object reference not set to an instance of an object.
Restore Selective Disk for Azure VM
In this section, I will show you how to restore selective (individual) data disks for Azure virtual machines.
As a reminder, this only works if you have enabled selective disk backup for your virtual machines. In this example, the OS and Data Disks (LUN 10, 20, and 30) are included as shown in the figure below.
Open Windows Terminal or use the Azure Cloud Shell at https://shell.azure.com and run the following commands. You can choose between PowerShell or the Azure CLI.
First, we need to get the existing recovery points available for the virtual machine similar to the previous section (Restore OS Disk).
Azure CLI
In this example, I want to restore from the most recent backup. I’ll update the command to place the recovery point into a variable by querying its name. This returns only the recovery point name.
# Sign in to Azure -> Skip if you are using the Cloud Shell
az login
# Set the Azure context for the desired subscription where your virtual machine and vault are deployed
az account set --subscription "xxxx-xxxx-xxxx-xxxx"
# Set the required variables
$resourceGroupName="<ResourceGroupNameForTheVaultHere>"
$recoveryServicesVaultName="<RecoveryServicesVaultNameHere>"
$virtualMachineName="<VMNameHere>"
# Get the most recent recovery point available and store the recovery point name into a variable
$rpname=$(az backup recoverypoint list --resource-group $resourceGroupName --vault-name $recoveryServicesVaultName --container-name $virtualMachineName --item-name $virtualMachineName --query [0].name --backup-management-type AzureIaasVM --output tsv)Next, we need to get the selected recovery point information to see which disk is included or excluded so we can restore the desired disk. You can run the following CLI command:
# Shows details of a particular recovery point
az backup recoverypoint show --container-name $virtualMachineName --backup-management-type AzureIaasVM --item-name $virtualMachineName --name $rpname --resource-group $resourceGroupName --vault-name $recoveryServicesVaultNameFor each recovery point, you will see the information on the included and excluded disks as shown in the figure below under the recovery point disk configuration section. LUN -1 is the OS Disk and LUN 10, 20, ad 30 are the Data Disks. For each additional data disk, you will see its corresponding LUN number.
Now we have the recovery point name stored in a variable called “$rpname” and the list of the included and excluded disks, we can restore the desired disk by using the flag “–diskslist” followed by the number of the disk(s) to be restored. E.g –diskslist 20 30.
Please note that the OS Disk will always be restored along with any data disk that you desire to restore, you cannot exclude the restoration of the OS Disk.
# Set the required variables
$resourceGroupName="<ResourceGroupNameForTheVaultHere>"
$recoveryServicesVaultName="<RecoveryServicesVaultNameHere>"
$virtualMachineName="<VMNameHere>"
$targetResourceGroup="<TargetResourceGroupNameForStorageAccountHere>"
# If the storage account lives in a different resource group than the recovery services vault, then you need to use the Resource ID for the storage account
# E.g. /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountNameHere}
$storageAccountName="<StorageAccountNameHere/ResourceID>"
# Restore only the Data Disk with Azure CLI
az backup restore restore-disks --resource-group $resourceGroupName --vault-name $recoveryServicesVaultName --container-name $virtualMachineName --item-name $virtualMachineName --rp-name $rpname --target-resource-group $targetResourceGroup --storage-account $storageAccountName --diskslist 20 30If you open the Backup jobs blade under Monitoring in the Recovery Services vault from the Azure Portal and look for the Restore job operation details, you will see that the Data Disks (02 and 03) were restored and disk 01 was not restored as shown in the figure below.
PowerShell
Here is the PowerShell version for the same which is longer than CLI. I prefer to use Azure CLI.
In this example, I want to restore from the most recent backup. I’ll update the command to place the recovery point into a variable by using the index [0]. This returns only the most recent recovery point.
# Sign in to Azure - Skip if you are using the Cloud Shell
Login-AzAccount
# Set the Azure context for the desired subscription
Set-AzContext -Subscription "xxxx-xxxx-xxxx-xxxx"
# Set the required variables
$resourceGroupName="<ResourceGroupNameForTheVaultHere>"
$recoveryServicesVaultName="<RecoveryServicesVaultNameHere>"
$virtualMachineName="<VMNameHere>
# Get the recovery services vault object
$vault = Get-AzRecoveryServicesVault -ResourceGroupName $resourceGroupName -Name $recoveryServicesVaultName
# Set the recovery services vault context
Set-AzRecoveryServicesVaultContext -Vault $vault
# Get the backup item for the virtual machine based on workload type "AzureVM", and store it in the $backupItem variable
$backupItem = Get-AzRecoveryServicesBackupItem -BackupManagementType "AzureVM" -WorkloadType "AzureVM" -VaultId $vault.ID | Where-Object {$_.Name -like "*$virtualMachineName*"}
# Get the most recent recovery point available and store it into a variable
$rp=(Get-AzRecoveryServicesBackupRecoveryPoint -Item $backupItem -VaultId $vault.ID)[0]
The variable will include the full recovery point details that I want to restore as shown in the figure below.
Now we have the recovery point details stored into a variable called “$rp“, we can restore the desired Data Disks by adding the parameter -RestoreDiskList followed by the number of the disk(s) to be restored. E.g -RestoreDiskList 20,30 without space.
# Set the required variables
$resourceGroupName="<ResourceGroupNameForTheVaultHere>"
$recoveryServicesVaultName="<RecoveryServicesVaultNameHere>"
$virtualMachineName="<VMNameHere>"
$targetResourceGroup="<TargetResourceGroupNameForStorageAccountHere>"
# Target storage account name and resource group to use during the staging process
$storageAccountName="<StorageAccountNameHere>"
$storageAccountRG="<StorageAccountResourceGroupNameHere>"
# Restore Data Disks with Azure PowerShell
# The parameter -RestoreDiskList [LUN number(s) of disks with comma separated and without a space]
Restore-AzRecoveryServicesBackupItem -RecoveryPoint $rp -StorageAccountName $storageAccountName -StorageAccountResourceGroupName $storageAccountRG -TargetResourceGroupName $targetResourceGroup -VaultId $Vault.ID -RestoreDiskList 20,30That’s it there you have it! The complete guide of Azure VM selective disk backup and restore.
Summary
Azure Backup is a cloud-based backup solution that is part of a broad service presented to customers through Azure Recovery Services Vaults. Though cloud-native and platform as a service (PaaS), it is also possible to use Azure Backup on-premises as well as in the cloud. Azure Backup can replace your existing on-premises and off-site backup solution with a cloud-based solution that is reliable, secure, and cost-competitive.
Azure Backup is simple to configure and use, offering consistent copies with security features and management controls via the Azure portal.
- Learn more on how Azure Backup Integrates with Azure File Sync – Part I
- Learn more on how Azure Backup Integrates with Azure File Sync – Part II
- Learn more on how to enable Azure Site Recovery (ASR) on VMs using Azure Policy
We hope this article gave you a broad overview of how to restore individual disks for Azure virtual machines to help you minimize restore time, and get back in operation faster.
Do you want to explore the Azure Backup service more deeply, diving into the finer details of how things work, and helping people understand where it differs from what we traditionally used to do in the backup world? We highly recommend checking Azure Backup Deep Dive – Free Whitepaper.
__
Thank you for reading my blog.
If you have any questions or feedback, please leave a comment.
-Charbel Nemnom-
