Configure Backups for TDE-Encrypted Databases Using Service-Managed Keys

During a backup, Commvault selects the nearest Azure native backup for the database, creates a temporary application-consistent copy (prefix cv_copy_*) by restoring the native backup to the same instance, and generates a .bacpac file through DacFX-based export. The .bacpac file is staged onto the staging location on the access node. The .bacpac file is further copied to Commvault storage. DacFX-based backup is possible only if a suitable Azure native backup is available. All limitations of DacFX will apply to Azure managed instance including skipping databases over 2 TB. This method will protect databases configured with service-managed TDE, while databases configured with customer-managed TDE will continue to be protected using the Microsoft BACKUP DATABASE method.

Before You Begin

  • Ensure that the Azure managed instance database has at least one native backup available.

  • Update the bEnableDacFXForManagedAzureSQL entity setting value to 1 for the applicable access node connected to the Azure SQL Database Managed Instance.

  • Ensure that the Azure SQL managed instance has at least twice the database size allocated to free storage to hold the restored database temporarily.

  • Set a local staging path with Microsoft SQL Server Data-Tier Application Framework (DacFx) on the access node. By default, the staging path is the Job Results folder. If you want to specify a different path, set the path in the sStagePathForAzureSQLBackup setting.

    During the export process, the Data-Tier Application Framework (DacFX) generates temporary files that are stored in your chosen staging path. Make sure the drive you select has enough disk space to accommodate the export operation, as the temporary files may be up to three times the size of the database.

  • You must have the following Azure permissions:

    • Microsoft.Sql/managedInstances/encryptionProtector/read

    • Microsoft.Sql/managedInstances/databases/transparentDataEncryption/read

    • Microsoft.Sql/managedInstances/databases/backupShortTermRetentionPolicies/write

Considerations

By default, the Commvault software skips backing up Azure SQL databases with sizes larger than 2 TB. This limitation arises because very large databases experience a high failure rate due to Azure's limitations, especially when data export operations to the Azure cloud exceed 20 hours. For more information, see Microsoft Documentation.

To override this default behavior, enter the maximum size of the Azure SQL database (in GB) that can be protected in the nAzureSQLDBMaxSizeForExportInGB setting, for the applicable access node. The backup jobs do not include any database larger than this threshold.

Procedure

  1. Configure the Azure SQL database managed instance.

  2. Back up an Azure SQL managed instance.

    Note

    By default, the jobresults directory on the access node is used for staging during backups.

  3. Restore the Azure SQL managed instance.

    Note

    Optionally, you can specify a staging path for the .bacpac file. Otherwise, the jobresults directory is used by default if no staging path is selected.

×

Loading...