Azure Resiliency Map
Service catalog
Data Protection

Azure Backup & Site Recovery

The general-purpose recovery mechanism behind most other services in this catalog. Backup gives point-in-time restore (RPO = policy schedule); Site Recovery gives a continuously-replicating standby with orchestrated, still-manual failover. Neither is fast enough for Tier 0/1 on its own.

SLA 99.9% (Backup and Site Recovery service availability) — not a completion-time guaranteeLast verified 2026-08-13
Local

Backup vault, LRS, default (daily) policy

Recovery Services / Backup vault storing snapshots on a schedule. Default policy is once daily; enhanced policies support hourly for some workloads.

Replication
Asynchronous
RPO
Bounded by policy schedule — daily by default, down to roughly hourly with an enhanced policy
RTO
Restore time scales with data size — typically hours
Failover trigger
Manual (customer-triggered)
Protects against: Accidental deletion, corruption, ransomware — not infrastructure failure
Meets tier
T0
T1
T2
T3
T4
Zonal

Backup vault configured for ZRS

Vault storage redundancy set to Zone-Redundant Storage — protects the backup data itself from a zone loss. Doesn't change restore speed.

Replication
Synchronous
RPO
Same as the underlying policy schedule
RTO
Same as Local — restore time is unaffected by vault storage redundancy
Failover trigger
Manual (customer-triggered)
Protects against: Loss of backup data itself to a zone failure
Meets tier
T0
T1
T2
T3
T4
Regional

GRS vault + Cross-Region Restore, or Site Recovery (ASR) continuous replication

Two distinct mechanisms live under the same 'Recovery Services vault' umbrella: (1) Backup with a GRS/GZRS vault and Cross-Region Restore lets you restore into the paired region during a primary-region outage; (2) Site Recovery continuously replicates a running VM/app to a secondary region as a warm standby with orchestrated Recovery Plans.

Replication
Asynchronous
RPO
Backup: bounded by policy schedule. Site Recovery: as low as ~30 sec–5 min under normal conditions
RTO
Backup + CRR: hours (restore time). Site Recovery: minutes to roughly an hour, execution time only, once a recovery plan is triggered
Failover trigger
Manual (customer-triggered)
Protects against: Region-wide outage/disaster

Cross-Region Restore must be enabled per vault/policy in advance — it is not retroactive to an outage already in progress.

Meets tier
T0
T1
T2
T3
T4

Gotchas

high

Backup alone cannot meet Tier 0/1

The tightest realistic RPO from backup-and-restore is roughly an hour (enhanced/hourly policies), and RTO scales with data size regardless of policy — Tier 0 (15 min) and most of Tier 1 (1 hr) are not achievable through backup alone. Those tiers need continuous replication (Site Recovery, or a data-tier native geo-replication feature) instead.

high

Cross-Region Restore is opt-in and not retroactive

CRR must be explicitly enabled on the vault/policy before an outage happens. If it wasn't turned on ahead of time, you cannot enable it during the outage and use it — plan and drill this in advance, not during an incident.

medium

Backup and Site Recovery are frequently conflated in DR plans

They share the Recovery Services vault construct but do fundamentally different things: Backup gives point-in-time snapshots you restore into a new resource (slow, data-protection focused); Site Recovery gives a continuously-replicating warm standby with a much faster, orchestrated (but still manually triggered) regional failover. A DR plan that says 'we have Backup enabled' when the actual requirement is Site Recovery-grade RTO is a common audit finding.

Sources