(light music)
- Hi, welcome to the video series
on Azure Backup for SQL Server Databases on Azure VM.
My name is Pradeep Saran.
I'm one of the product managers for business continuity
and disaster recovery for databases.
The agenda that we have for today,
we're going to cover a quick overview
into Azure Backup service,
and we're going to take a look at workload protection
for SQL Server on Azure VM.
And we'll do a quick demo of that
and we'll quickly cover cost optimization
and ransomware protection.
So let's see how we protect the diverse set
of workloads in Azure.
So bottom up, if you can see
the native workload integration that we have,
Azure today supports wide variety of workloads,
and we are constantly adding new workload support regularly.
When we take a backup and then move the backup
to the data plane through secure channels,
we use private endpoints, we use NSG,
which is network security groups and Azure firewalls.
And once the data gets moved to the data plane,
it gets stored in multiple tiers.
So we have the snapshot tier,
which is basically used
for when we snapshot the databases,
and we have the standard tier
where we store the regular backups.
This standard tier is completely isolated
from the customer tenants,
and then we provide additional security elements to that.
And we also introduce archival tier,
which is basically used for long-term retention.
And coming to the availability levels,
we have LRS, ZRS and (RA-)GRS,
and we also provide built-in security.
We provide additional capabilities around RBAC
where you can grant owner permissions to your admins.
And we also provide encryption
where you can bring your own customer-managed keys
and other capabilities around Soft-Delete MUA,
which is multi-user authorization and immutability
and so on and so forth.
Now, moving on to the management plane
where you can basically configure access,
and manage all your backups in one single place,
and we also provide that built-in management at scale view.
So where you can see or manage your workloads
across different vaults and different subscriptions as well.
So, in terms of backing up
your SQL Server databases in Azure VM,
this is predominantly streaming-based backup.
So the backups are streamed out of the database engine
and then written to the Azure Backup managed storage,
also known as Recovery Services vault.
And as you can see in the image,
we take the intent from the customer
in the form of backup policy
and then we trigger a backup.
And we also install a backup extension on the Azure VM.
We don't install anything on the database.
And once we take the backup,
we stream it all the way to the Recovery Services vault.
So in terms of Recovery Services vault
and in terms of the backup options that we have,
we have full backup, differential backup, and log backups.
Predominantly, log backups can be used
for point-in-time restore in case if you're somebody
who's looking for granular restore capabilities,
you can leverage the power of log backups.
And then coming to some of the supported DB
and operating system versions,
we support right from SQL Server 2008 and the latest.
And we also support Windows Server 2008 R2
and whatever the latest is today.
And in terms of supported deployment models,
we support standalone Azure VMs
and we also support SQL AG,
which is always on availability group,
which is predominantly in case
if you are using always HE as your HS solution,
we support backups on that as well.
In terms of performance,
we do, at present, 200 MBPS transfer rates
and we are going to increase that to 350 MBPS
as on end of March 2023.
Couple of key call outs here.
We support all recovery models
and we also support SQL data compression.
Again, this is a very good option
in case if you're looking to optimize on cost.
And we also support TDE-based database backups,
which means if you are using
transparent data encrypted backups on your database,
we support backing up those databases as well.
And we also have in-built checksum mechanism.
So in terms of checksum,
we basically do some checksum technique
where we increase the reliability of your backup
and restore capabilities.
Another call out that I would would like to do
is we have a mechanism to understand
if there is any lock chain breaks.
So if you're doing your backup
and if there is a lock chain break
and if it goes unnoticed,
you might have some problems
when you're trying to restore the backup.
We all know how expensive the downtime is going to be.
So we have this capability where we are able to identify
if there is any lock chain break.
And as part of a remedial action,
we automatically generate a full backup
which will basically take care of that.
And in terms of support
for new operating system versions and DB versions,
we have customers asking us how do we support that?
So when there is a new OS or DB version that comes on board,
we do sanity testing to make sure
there is no performance issues
and then the backup cell is updated automatically
without any impact to your databases.
So let's see a quick demo
of the streaming-based solution that I spoke about.
So here, first, we will get
into the the Recovery Services vault
and then from there, you can basically discover your VM
on which your SQL database is installed.
First step is we are doing discovery of the databases
and then we need to select the VM
on which the SQL server is running.
And then we can go ahead and do the configuration backup.
So we are able to successfully discover that.
And then let's see how we can configure the databases.
I'll configure the backup for the databases.
So here is where you configure the backup policy.
You can use the default policy or you can leverage,
you can customize based on your needs.
We talk about frequency of the full backup
and how often you want to retain those backups.
And we also have the capability for log backup as well.
So that is predominantly used for point-in-time restore.
And then we also spoke about capability
on SQL backup compression technique as well.
So all this comes into the backup policy that you create.
And then we need to add the databases,
which we discovered a while ago.
So here is the VM or the instance.
And then we can select the databases
that we discovered on that VM
and then we can get going, yeah.
So here we can see that we were successfully able
to back up those databases.
And we can see how we can restore
some of the databases as well.
And get into the VM and then all are healthy.
We can either restore from here
or we can convey details to restore the specific database.
So there are multiple options
that I would like to talk about here.
One is alternate location restore.
So if you select that, you need to select your target VM
on which you want to restart this database.
So I've selected the target VM and the instance
and then I need to select the restore point here.
So here, there are multiple options.
You can do full and differential.
In case if you have a complete backup,
you can pretty much use that.
Or in case if you're looking at granular restore,
if you want point-in-time restore,
you can select the logs backup, log-based backup.
And again, here is the advanced configuration
of the database.
And we also have OLR, which is original location restore
in case if your source VM,
if specific database is corrupted,
and you want to restore a specific database
on the source VM.
Predominantly, you can do that
and you can set up the same option here,
full or differential or you can do point-in-time restore
and restore as files predominantly for customers
who wants to restore the database as files.
And then on the target VM,
they want to basically run some tests using native tools.
That is another option as well.
And another option I would like to talk about
is cross-regional restore, right?
So we have a capability called CRR.
So this is a vault level setting
that you need to do it on backup configuration.
So the the main use case of CRR
or cross-regional restore is you can use it
for both your BCDR drills and outtake scenarios.
And then you can, once you enable this,
you can see that the cross-regional restore is enabled here.
Once you enable that, automatically,
we sync these backups to the secondary region as well.
So let's get into the vault
and then see the backup stack we've done.
So as you can see, this is the primary region
and we have the secondary region enabled as well.
So this is nothing but, so in my case,
the primary region was east-us-2.
And as you can see, Azure pad region
for that is Central U.S.
So it clearly shows that your secondary region
is Central U.S.
And whatever the backups that was there
in the primary region,
we can sync to the secondary region.
And then from there on,
in case if your primary region is down,
you can do restore automatically
from the secondary region as well.
So nothing changes in terms of experience.
You can do pretty much all the restore capabilities
from the secondary region as well.
So pretty much, you need to select the target vault.
You need to have a target vault
on the secondary region and the target VM.
That way, you can restore the databases on the target VM.
So let's see some of the capabilities that we have
in terms of backup center.
So this is kind of a single pane of glass,
where you can look at data across multiple subscriptions
and multiple vaults and multiple data sources as well.
You can see data about jobs and how many VM
or how many data protect,
how many data sources are protected.
And you can see data across multiple subscriptions
and multiple data source types.
So this is one place
where you can do pretty much everything.
You can create your backups, restore your backups.
You can create your own policies,
and create your vault, so whatnot, right?
So we also have a capability to showcase the alerts
on the same backup center.
So if you can see, get it to seven alerts.
So there is a alert that talks
about there is Soft Delete being disabled on the vault.
So it could be by mistake, somebody deleted it,
or one of your malicious actors
have kind of deleted the Soft Delete on the vault
to create some issues and so on and so forth.
So automatically, we get a alert
and administrator will be notified on that as well.
Let's see what are the capabilities that we have.
So you can look at all the backup instances
which are being managed using the backup center
and see all list.
And you can also manage all your backup policies
from one place.
And same with all the vaults
which are part of your subscription.
We can manage everything there.
And we also have backup reports.
And you can also use or leverage Azure policies for backup.
So in case if you want to write your detailed
extensive Azure policy,
let's say you are bringing up your SQL VM
and you need to have specific tags on the VM,
you can write a policy on that.
So it pretty much looks like this.
And automatically, it's applied
when you bring up the SQL VM.
And another use case is basically,
if you want to enable Soft Delete for the backup vaults,
we can write that as mandatory policy, Azure policy.
So now that we are done with the demo,
let's see what we have for cost optimization.
In terms of cost optimization one can leverage,
pricing calculators which provide granular item level view
to understand what are your costs going to be.
And we also provide support for reserved capacity.
If you're getting into pre-committed usage,
you get up to 24% savings on your backup cost.
In terms of optimizing your cost,
we also have capability around intelligent tiering,
where during backup, you can say after a few months,
move the backups to the archival tier
for long-term retention.
And then we automatically move those backups
to the archival tier.
And one can also leverage the backup reports
so that these backup reports provide you great insights
and it'll also kind of show you patterns
which can help right-size your backup storage as well.
But it can also clean up the backups
to remove inactive or deleted data sources.
So moving on to the reserved capacity
I spoke spoke about earlier.
So in terms of reserved capacity,
if you are getting into pre-commitment
of 100TB per month, for a year, we give you 12% discount.
And for three years, we are giving you 20% discount.
And if you're getting
into one petabyte a month pre-commitment,
you get 16% and 24% respectively.
And in terms of the pre-commitment
or the reserved capacity for Azure backup,
you can pay upfront or you can pay on a monthly basis
at no additional cost.
And you can use this for a single subscription
or across multiple subscriptions as well.
So let's see what we have for ransomware protection.
So there's a capability called Enhanced Soft Delete.
So we had Soft Delete.
And what this Soft Delete will do
is basically protect your backups
from accidental or malicious deletes.
So if you delete your backups by mistake,
we don't immediately delete them completely.
So we move them to Soft Delete state
where we retain those backups for seven days.
So this was a capability we had for Soft Delete.
So what we did is we came up with Enhanced Soft Delete
where we store that or retain those backups
for 14 days before permanently deleting them.
And then you can basically configure
the retention period.
And during the retention period
which is, by default, 14 days, we don't charge the customer.
And then anything goes beyond the 14-day period,
you will incur additional charges.
So the options that we have
in terms of Enhanced Soft Delete,
we have disable, enable, and always on enable.
And this is a vault level setting that you can use today.
And again, this is a public preview feature that we have.
We already have the Soft Delete capability
and Enhanced Soft Delete is currently public preview.
And coming to immutability, right?
So immutability is basically a vault level setting, okay?
So once you create a recovery point,
so it cannot be deleted or its retention period
cannot be reduced, right?
So it could be some malicious actor
in your own organization who's trying to delete
or reduce the backup retention period.
So that's the use case of having this immutability feature.
And this is, again, a vault level setting
for Recovery Services vault and backup vault.
So what is permitted here is you can go ahead
and still stop the protection and retain data.
And what we don't allow is you cannot stop
and delete that data.
So we stop that delete operation completely
once you enable the immutable vault.
And what is also permitted is you can edit
and change the backup policy
to increase the retention period,
but you cannot decrease the retention period.
So these are some of the restrictions
that comes along with the the feature itself.
And we also have Modern Air Gap.
So basically this talks
about the Recovery Services vault capability that we have.
So traditionally, if you take Air Gap solutions,
where there not be no network connectivity
or data will be completely isolated and offline.
So when it comes to Recovery Services vault,
we leverage Modern Air Gap capabilities
where it's secure network, we connect to secure network.
And we also have the data
which is isolated and online as well.
So if you can see, we use various mechanisms to do this.
One is we enforce MFA, which is multi-factor authentication.
And we also provide granular RBAC capabilities.
And we also have MUA, which is multi-user authorization.
And we also bring in capability of private endpoints
where, if you're transferring your backups
from your data source to the target VM
or your Recovery Services vault,
one can leverage private endpoints as well.
And on top of that,
we also provide security alerts to monitor all this.
These are overview of what are the new capabilities
that's available in BCDR today.
And this pretty much covers about Azure VM,
SQL VM, SAP HANA, and what we are doing
in terms of security and backup center as well.
And here are some of our resources
which you can go in and understand more
about Azure BCDR capability.
And that's all we had in this video series.
Looking forward to meeting all in the next one.
Thank you.