Create a Microsoft Azure recovery target for Active Directory forest recovery

Create a recovery target for the Microsoft Azure subscription you want to recover your domain controllers to.

Start the Add Microsoft Azure target wizard

1. From the Command Center navigation pane, go to Protect > Active Directory.

   The Overview page appears.

2. On the Forests tab, click the forest.

   The forest page appears.

3. On the Runbook tab, click the runbook.

   The runbook page appears.

4. On the Runbook settings tab, click View recovery targets.

   The Recovery targets dialog box appears.

5. Click Add recovery target.

   The Select target dialog box appears.

6. Select Microsoft Azure.

7. Click Select target.

   The Add Microsoft Azure target wizard appears.

General page

1. Enter a name for the recovery target.

2. To register a new Azure subscription, beside Destination, click the add button.

   The Add hypervisor dialog box appears.

3. Download the Active Directory Forest access node package.

4. Install the access node package on the server you want to use as your access node.

   Important access node requirements

   • The access node must be a VM in the Azure region that the domain controllers will be restored to.

   • When installing the access node package, select a drive on the server that has 10 GB or more of free hard disk space.

   • For adequate performance during restores of domain controllers, the access node must have 16 GB or more of memory.

5. Wait until the installation completes successfully.

6. In the Add hypervisor dialog box, refresh the Access nodes list, and then select the host you installed the access node package on.

7. Enter a name for the hypervisor.

8. In Subscription ID, enter the ID of the Azure subscription.

9. To create an Azure app that will be used to connect to the Azure tenant, click Deploy a new application.

   The script to create a new application appears.

   Note

   The script creates an Azure AD app registration and service principal, and assigns the following Azure RBAC roles at the subscription level:

   • Storage Blob Data Contributor: Enables read, write, and delete access to blob data used during restore operations.

   • Contributor: Enables creation and management of Azure resources, including virtual machines, disks, networks, and storage accounts.

   These roles are required for automated provisioning and restore of domain controllers in Azure. The script does not grant permission to assign roles to other identities.

10. Copy the script.

11. Open an Azure Cloud Shell in the Azure subscription, copy the script to the Cloud Shell, and then run the script.

12. Copy the following values, output by the script, to a location where you can access them later:

    • Tenant ID

    • Application ID

    • Application secret

13. For Credential, select existing credentials or add new credentials.

    Steps to add new credentials

    1. Enter a name for the credentials.

    2. Enter the app ID, tenant ID, and app secret that were output by the script.

    3. Select the Azure cloud environment where your application or service is hosted.

    4. To enter the authentication endpoint details, enable the Show endpoints toggle key, and then enter the authentication, storage endpoint, and management endpoints.

    5. Click Save.

14. Click Save in the Add hypervisor dialog box.

15. For Destination, select the Azure recovery target you created.

16. For Access node, select the server you installed the access node package on.

17. For Security, select the roles that need access to the Azure recovery target.

    Note

    You can ignore the VM display name options because they are not used.

18. Click Next.

Destination options page

1. For Resource group, select the resource group from the Azure subscription that recovered VMs will be associated with.

2. For Region, select the Azure region that the access node is in.

3. For Storage account, select a storage account from the Azure subscription that will host the hard disks of the recovered VMs.

4. For Virtual network, select the virtual network that the access node is in.

5. For Availability Zone, Storage type, VM size, Security group, and Create public IP, enter appropriate values or leave the default values.

6. Click Next.

Repave options page

On this page, you can specify a clean image to use for restored domain controllers. If you don't specify an image, a Commvault-hosted image is used.

Repave options for the Windows Server version of the source domain controllers are as follows:

• Windows Server 2025: Specify your own image.

• Windows Server 2022: Use a Commvault-hosted image or specify your own image (Windows Server 2022 or later).

• Windows Server 2019: Use a Commvault-hosted image or specify your own image (Windows Server 2019 or later).

To specify your own Windows Server image, follow these steps:

1. To add your VM template, click Add.

   The Custom image page appears.

2. For Operating system, select Windows.

3. Select an image from the list of templates.

4. Click Save.

If you specify your own image, follow these steps to specify a software cache:

1. For OS Type, select Windows.

2. Under Software cache, select the server where the software cache is configured.

3. Click Next.

   Recommended location for software cache

   Place the software cache on the access node that has connectivity to your recovered domain controllers.

   Steps to configure a new software cache

   1. From the Command Center navigation pane, go to Explore > Companies.

   2. On the Software caches tab, click Add to create a new software cache and specify the server and details to host the cache.

   3. After creating a new software cache, from the actions list, select the Sync option to ensure it is up to date.

Advanced options page

1. To specify a server group, enable the Enable association to a server group toggle key.

2. For Associate destination server to this server group, select a server group to associate recovered domain controllers with.