Azure Backup & Site Recovery
The general-purpose recovery mechanism behind most other services in this catalog. Backup gives point-in-time restore (RPO = policy schedule); Site Recovery gives a continuously-replicating standby with orchestrated, still-manual failover. Neither is fast enough for Tier 0/1 on its own.
Backup vault, LRS, default (daily) policy
Recovery Services / Backup vault storing snapshots on a schedule. Default policy is once daily; enhanced policies support hourly for some workloads.
- Replication
- Asynchronous
- RPO
- Bounded by policy schedule — daily by default, down to roughly hourly with an enhanced policy
- RTO
- Restore time scales with data size — typically hours
- Failover trigger
- Manual (customer-triggered)
Backup vault configured for ZRS
Vault storage redundancy set to Zone-Redundant Storage — protects the backup data itself from a zone loss. Doesn't change restore speed.
- Replication
- Synchronous
- RPO
- Same as the underlying policy schedule
- RTO
- Same as Local — restore time is unaffected by vault storage redundancy
- Failover trigger
- Manual (customer-triggered)
GRS vault + Cross-Region Restore, or Site Recovery (ASR) continuous replication
Two distinct mechanisms live under the same 'Recovery Services vault' umbrella: (1) Backup with a GRS/GZRS vault and Cross-Region Restore lets you restore into the paired region during a primary-region outage; (2) Site Recovery continuously replicates a running VM/app to a secondary region as a warm standby with orchestrated Recovery Plans.
- Replication
- Asynchronous
- RPO
- Backup: bounded by policy schedule. Site Recovery: as low as ~30 sec–5 min under normal conditions
- RTO
- Backup + CRR: hours (restore time). Site Recovery: minutes to roughly an hour, execution time only, once a recovery plan is triggered
- Failover trigger
- Manual (customer-triggered)
Cross-Region Restore must be enabled per vault/policy in advance — it is not retroactive to an outage already in progress.
Gotchas
Backup alone cannot meet Tier 0/1
The tightest realistic RPO from backup-and-restore is roughly an hour (enhanced/hourly policies), and RTO scales with data size regardless of policy — Tier 0 (15 min) and most of Tier 1 (1 hr) are not achievable through backup alone. Those tiers need continuous replication (Site Recovery, or a data-tier native geo-replication feature) instead.
Cross-Region Restore is opt-in and not retroactive
CRR must be explicitly enabled on the vault/policy before an outage happens. If it wasn't turned on ahead of time, you cannot enable it during the outage and use it — plan and drill this in advance, not during an incident.
Backup and Site Recovery are frequently conflated in DR plans
They share the Recovery Services vault construct but do fundamentally different things: Backup gives point-in-time snapshots you restore into a new resource (slow, data-protection focused); Site Recovery gives a continuously-replicating warm standby with a much faster, orchestrated (but still manually triggered) regional failover. A DR plan that says 'we have Backup enabled' when the actual requirement is Site Recovery-grade RTO is a common audit finding.