Configure an Azure cleanroom site

The Express configuration creates an Azure application called Commvault Cloud App in your cleanroom recovery Azure subscription. For details about the resources that Commvault creates in your cleanroom recovery Azure subscription when you use the Express configuration and/or Deploy automatically using default template options, see Resources automatically created in your Azure or Commvault subscription for cleanroom recovery.

Create an Azure subscription for cleanroom and register Azure resource providers

• In the Azure portal, create a new Azure subscription that's only for cleanroom recovery.

Start the add cleanroom site wizard

1. In the Command Center navigation pane, go to Secure > Cleanroom recovery.

2. On the Cleanroom sites tab, click Add cleanroom site.

3. Select Microsoft Azure.

4. Click Next.

Select deployment type

1. Choose how to deploy:

   • Use Commvault-provided resources, which provide optimized settings

   • Use your own resources

General page

1. Enter a name for the cleanroom site.

2. For Region, select the region to recover VMs to.

3. Select Express configuration.

4. Sign in with Microsoft as a Global Administrator for your cleanroom recovery Azure subscription, and then consent on behalf of your organization.

5. If you're a Commvault software customer, when you're prompted to sign in again and asked to grant access to Azure Resource Manager, sign in as an Owner for your cleanroom recovery Azure subscription, and then consent on behalf of your organization.

   Commvault creates the app.

6. Return to the wizard, and then enter your Azure subscription ID.

7. Click Next.

Recovery options page

Modify the settings as needed.

• Resource group: The Azure resource group that VMs and associated resources are deployed to.

• Region: The Azure geographic region that resources are created in.

• Storage account: The Azure storage account that hosts VM disks.

• Availability Zone: The Azure Availability Zone for the recovered VMs, if zonal deployment is required.

• Storage type: The disk performance tier (for example, Standard SSD) for VM disks.

• VM size: The Azure VM size, including CPU, memory, and disk configuration, for recovered workloads.

• Virtual network: The Azure virtual network (VNet) that VMs are deployed to.

• Security group: The network security group (NSG) applied to recovered VMs to control inbound and outbound traffic.

• Create public IP: Specifies whether recovered VMs are assigned a public IP address.

Infrastructure page

Modify the settings as needed.

• Max access nodes per workload type in a recovery group: The maximum number of access nodes that can be created (scaled) for each workload type in the recovery group.

• Virtual network: The virtual network for new access nodes.

• NAT gateway public IP prefix: The public IP prefix associated with the NAT gateway for outbound internet connectivity from infrastructure resources.

• Security group: The network security group for new access nodes.

• Create public IP address: Specifies whether new access nodes are assigned a public IP address.

• Workload server group: The server group for recovered workload VMs.

• Infrastructure server group: The server group for infrastructure components such as access nodes or proxy servers.

• Resource group: The Azure resource group that infrastructure components for access node scaling are created in.

• Default VM size: The default VM size for new access nodes.

• Create custom image: Specifies whether a custom Azure image is used for new access nodes. If disabled, a default system image is used.

Advanced options page

1. Specify validation options:

   • Run threat scan: Run a threat scan on all VMs.

     Every 7 days, the count of discovered threats is reset to 0.

   • Run Windows Defender: Run a Microsoft Windows Defender Antivirus scan on Windows VMs.

2. For Custom scripts, you can specify validation scripts to confirm that the recovered data is usable and applications are functioning correctly:

   1. Click Add.

   2. Upload a file or enter a UNC path and credentials to access the path.

      • Windows: Enter as [file].ps1.

      • Unix: Enter as \\[path]\[file].sh.

   3. Enter a name for the script, and then click Save.

3. To finish creating the cleanroom site, click Submit.

For information about other settings on this page, see Modify settings for a cleanroom recovery group.

Summary page

1. Review the configuration.

2. Click Finish.

The Custom configuration provides Bash and PowerShell commands for creating the Azure application and access to Azure Cloud Shell for running the commands.

Create an Azure subscription and register resource providers

1. In the Azure portal, create a new Azure subscription that's only for cleanroom recovery.

2. In the new subscription, register the following Azure resource providers. You must have Owner or Contributor permissions in the subscription.

   • Microsoft.Support
   • Microsoft.Storage
   • Microsoft.SerialConsole
   • Microsoft.ResourceNotifications
   • Microsoft.ResourceGraph
   • Microsoft.Portal
   • Microsoft.OperationalInsights
   • Microsoft.Network
   • Microsoft.MarketplaceOrdering
   • Microsoft.MachineLearning
   • Microsoft.GuestConfiguration
   • Microsoft.Features
   • Microsoft.CostManagement
   • Microsoft.Consumption
   • Microsoft.Compute
   • Microsoft.Commerce
   • Microsoft.CloudShell
   • Microsoft.ClassicSubscription
   • Microsoft.ChangeAnalysis
   • Microsoft.Billing
   • Microsoft.Authorization
   • Microsoft.ADHybridHealthService

Start the add cleanroom site wizard

1. In the Command Center navigation pane, go to Secure > Cleanroom recovery.

2. On the Cleanroom sites tab, click Add cleanroom site.

3. Select Microsoft Azure.

4. Click Next.

Select deployment type

1. Choose how to deploy:

   • Use Commvault-provided resources, which provide optimized settings

   • Use your own resources

General page

1. Enter a name for the cleanroom site.

2. For Cleanroom site, leave Create new selected.

3. For Region, select the region to recover VMs to.

4. Select Custom configuration.

5. For Destination hypervisor, leave Create new selected.

6. Enter the ID of your cleanroom recovery Azure subscription.

7. In the information box, click Deploy a new application.

   The Deploy a new application dialog box appears.

   You can also create the Azure application in the Azure portal. For instructions, see Quickstart: Register an application with the Microsoft identity platform.

8. In the commands, replace "Contributor" with Commvault_Cleanroom.json.

   For details about the permissions that Commvault creates in your cleanroom recovery Azure subscription when you use Commvault_Cleanroom, see Resources automatically created in your Azure or Commvault subscription for cleanroom recovery.

9. In the information box, click Open Azure Cloud Shell, log on to the Azure portal as the subscription owner, and then execute the displayed commands to deploy the application.

10. Copy the following values, and then return to the wizard:

    • Tenant ID

    • Application ID

    • Application secret

11. Use the copied values to create a new credential.

12. Click Next.

Advanced options page

1. Specify validation options:

   • Run threat scan: Run a threat scan on all VMs.

     Every 7 days, the count of discovered threats is reset to 0.

   • Run Windows Defender: Run a Microsoft Windows Defender Antivirus scan on Windows VMs.

2. For Custom scripts, you can specify validation scripts to confirm that the recovered data is usable and applications are functioning correctly:

   1. Click Add.

   2. Upload a file or enter a UNC path and credentials to access the path.

      • Windows: Enter as [file].ps1.

      • Unix: Enter as \\[path]\[file].sh.

   3. Enter a name for the script, and then click Save.

3. To finish creating the cleanroom site, click Submit.

For information about other settings on this page, see Modify settings for a cleanroom recovery group.

Summary page

1. Review the configuration.

2. Click Finish.