How to automate On-Demand Azure Backup for Azure Virtual Machines using PowerShell

[Guest Srinath Vasireddy]

This guest post is authored by Swathi Dhanwada, Customer Engineer 2, who is frequently seen answering Azure Backup community queries.

 

 

 

Azure Backup supports multiple backups of Azure Virtual Machines per day using Enhanced Policy. For hourly backup, the minimum RPO is 4 hours and the maximum is 24 hours. You can set the backup schedule to 4, 6, 8, 12, and 24 hours respectively. Learn how to back up an Azure VM using Enhanced policy. This feature is only available to unprotected VMs that are new to Azure Backup. VMs that are already protected with existing policy can't be moved to Enhanced policy. To overcome this, you can run an multiple on-demand backup of a VM per day after you set up its protection. Keep these details in mind:

 

• If the initial backup is pending, on-demand backup creates a full copy of the VM in the Recovery Services vault.
  
• If the initial backup is complete, an on-demand backup will only send changes from the previous snapshot to the Recovery Services vault. That is, later backups are always incremental.
  
• You can’t trigger on-demand backups by disabling scheduled backup.
  

 

Below are the steps to automate the on-demand backup for azure virtual machines using Azure Automation.

 

Step1

 

 

Create an Automation resource with system managed identity. To assign permissions to managed identities, complete the following steps:

 

• 
  Sign in to Azure interactively using the Connect-AzAccount cmdlet and follow the instructions:
   
  

 

 

 

 

 

Sign in to your Azure subscription

`$sub = Get-AzSubscription -ErrorAction SilentlyContinue

if(-not($sub))

{

Connect-AzAccount

}`

 

If you have multiple subscriptions, set the one to use

Select-AzSubscription -SubscriptionId <SUBSCRIPTIONID>

 

 

 

 

 

• Provide an appropriate value for the following variables and then run the script:
  

 

 

 

 

 

$resourceGroup = "resourceGroupName"

$automationAccountId = "xAutomationAccount"

 

 

 

 

 

• Use the PowerShell cmdlet New-AzRoleAssignment to assign a role to the system-assigned managed identity:
  

 

 

 

 

 

$role1 = "Backup Operator"

 

$SAMI = (Get-AzAutomationAccount -ResourceGroupName $resourceGroup

-Name $automationAccount).Identity.PrincipalId

New-AzRoleAssignment

-ObjectId $SAMI

-ResourceGroupName $resourceGroup

-RoleDefinitionName $role1

 

 

 

 

 

Step2

 

 

Verify if required modules are imported to the Automation resource. If not, import the following modules from the Modules gallery in the order given below:

 

• 
  Az.Accounts
   
   
  
• 
  Az.RecoveryServices
   
  

Step3

 

 

Create PowerShell Runbooks in the Automation Resource. You can create multiple Runbooks based on which set of virtual machines you want to protect.

 

Step4

 

 

Edit the Runbook and write script to choose which virtual machines to take a backup. You can create scripts that suit your requirements.

 

 

 

Script to trigger on demand backup for single vm

 

 

 

 

 

Get-AzRecoveryServicesVault -Name "<recoveryvault name>" | Set-AzRecoveryServicesVaultContext

 

$namedContainer = Get-AzRecoveryServicesBackupContainer -ContainerType AzureVM -FriendlyName "<azurevmname>"

 

$item = Get-AzRecoveryServicesBackupItem -Container $namedContainer -WorkloadType AzureVM

 

$job = Backup-AzRecoveryServicesBackupItem -Item $item

 

 

 

 

 

• Save the script.
  
• Test the script using “Test Pane”.
  
• Publish the Runbook.
  

Step5

 

• Schedule the Runbook. While scheduling the Runbook, you can pass on the parameters required for the PowerShell Script.
  
• The sample script takes the retention as an input. So, if you need to schedule a weekly snapshot and retain for 8 weeks, create a weekly schedule as mentioned below and specify the retention as 56 days (8 weeks). You can create monthly and yearly schedules (run every 12 months) in a similar manner. You can monitor the success/failure of these backups using the “Jobs” tab of Runbooks.
  

 

Reference Documents:

 

• Configure Azure RBAC for runbooks
  
• Create Automation Account via Azure Portal
  
• Troubleshooting backup failures on Azure virtual machines
  
• Use Azure role-based access control to manage Azure Backup recovery points
  

 

Continue reading...