# Restores for Azure VMs and Files

For Azure VMs, you can restore full VMs, restore guest files and folders, and restore a disk and attach it to an existing VM.

## End User Restores

End users can restore VMs either in place or out of place. The VM display name setting is the only value that end users can change in the Restore options dialog box.

End users can restore a VM disk to an existing VM.

If the VM display name is the same as an existing VM on the destination, the restore fails.

## Considerations

- An application security group (ASG) is retained on a restored VM only if the VM is restored to the same network. If the VM is restored to a different region or a different network, then the ASG is not retained.

- For Azure managed disks with Availability Zones (AZs), whether the AZ information is restored depends on whether the region you restore the VMs to supports AZs:

  - If the region supports AZs, the AZ information is restored.

  - If the region doesn't support AZs, the AZ information is not restored.

- You can back up and restore Azure managed disks that are enabled with encryption at the host. Encryption at the host applies to Azure managed disks that reside on Windows or Linux VMs, but only to data at rest, with no effect on guest files restores.

- Restores to different hypervisors are supported when a VM is encrypted with customer-managed encryption keys.

- For Linux virtual machines that use the B-tree file system (Btrfs), file-level recovery requires that the MediaAgent operating system also support Btrfs.

## Supported Restores for Encrypted VMs

| Server-side Encryption | Server-side Encryption with CMK | Azure Disk Encryption​ | Encryption at Host | Confidential VMs
--- | --- | --- | --- | --- | ---
Snap/Backup Copy​ | Yes​ | Yes​ | Yes​ | Yes​ | Yes​
Cross-region Restore​ | Yes​ | Yes​ | Yes (in the same Azure geography)​ | Yes​ | Yes (in the same Azure geography)​
Cross-subscription Restore​ | Yes​ | Yes​ | No​ | Yes​ | No​
Cross-region cross-subscription Restore​ | Yes​ | Yes​ | No​ | Yes​ | No​

## VMs Encrypted with Azure Key Vault

- Restores of encrypted VMs to a different subscription are not supported due to an Azure limitation.

- Restoring to a different region under the same subscription automatically creates a new key vault, and the restore job completes successfully. For information, see AZR0002: Out of place VM restore to different region might fail when source VM is encrypted.

- By default, keys and secrets are not accessible to subscription users when the Key Vault is restored. The restore operation only adds the application's service principal in the Key Vault access control as an authorized user. If necessary, the subscription administrator can modify the permissions in the Azure portal.

- Microsoft restrictions for VMs that are encrypted using Azure Key Vault effect backup and restore capabilities in the Commvault software. For more information, see Azure Key Vault.

- For VMs encrypted with customer-managed encryption keys, full VM restores complete successfully. However, for full VM restores from streaming backups, the customer-managed encryption key settings or disk encryption sets (DES) are not applied to the destination VM. You must manually apply the DES settings to the destination VM in Azure.

- During full VM restores, a storage account must exist in the region of the restored VM (an Azure Standard or Premium general-purpose storage account). This account acts as a staging area when a VM is restored as managed VM.

×

Loading...