Rediger

Azure MCP Server tools for Azure Backup

When you use Azure MCP Server, you can manage Azure Backup resources through natural language prompts by using the Model Context Protocol (MCP). Azure Backup supports two vault types: the Recovery Services vault (RSV) and the Backup vault, which is also known as the Data Protection Platform (DPP). You can create and configure backup vaults, define and update backup policies, and protect and undelete items. You can also manage governance settings like soft delete and immutability, configure multiuser authorization (MUA), and monitor backup jobs and recovery points.

Azure Backup provides cloud-based capabilities for your applications. For more information, see the Azure Backup documentation.

Note

Tool parameters: The Azure MCP Server tools define parameters for data they need to complete tasks. Some of these parameters are specific to each tool and are documented here. Other parameters are global and shared by all tools. For more information, see Tool parameters.

Backup: Get status

This tool checks the backup status of an Azure resource through Azure Backup. It returns whether the resource is protected, along with vault and policy details. Use it to verify whether a virtual machine, disk, storage account, or other data source is backed up. It requires the Azure Resource Manager resource ID for the data source and the Azure region where the resource exists.

Example CLI command

azmcp azurebackup backup status \
  --datasource-id <datasource-id> \
  --location <location>
Parameter Type Required Description
datasource-id string Yes The datasource identifier. For VM/FileShare/DPP workloads, use the Resource Manager resource ID (for example, /subscriptions/.../virtualMachines/myvm). For RSV in-guest workloads (SQL/SAPHANA), use the protectable item name from protectableitem list (for example, SAPHanaDatabase;instance;dbname).
location string Yes The Azure region (for example, eastus, westus2).

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
❌ ✅ ❌ ✅ ❌ ❌

Disaster recovery: Enable cross-region restore

This tool enables cross-region restore (CRR) on a geo-redundant storage-enabled backup vault so that you can recover backups from a secondary region.

Example CLI command

azmcp azurebackup disasterrecovery enable-crr \
  --vault <vault> \
  --resource-group <resource-group> \
  [--vault-type <vault-type>]
Parameter Type Required Description
vault string Yes The name of the backup vault (Recovery Services vault or Backup vault).
resource-group string Yes The Azure resource group name.
vault-type string No The type of backup vault: rsv for a Recovery Services vault or dpp for a Backup vault (Data Protection Platform). The tool autodetects the type for existing vaults when you omit this parameter.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
✅ ✅ ❌ ❌ ❌ ❌

Governance: List resources without backup policy

This tool scans your subscription and lists Azure resources that aren't protected by any Azure Backup policy. It uses two discovery paths: ARM resource enumeration finds top-level unprotected resources, and Recovery Services vault discovery finds protectable sub-resources that a vault discovers but doesn't yet protect. Results include a discoverySource value (arm or vault), and vault-discovered items include protectionState so you can distinguish never-protected items from items where protection stopped.

You can filter results by resource type, resource group, or tags. Tag filtering applies only to ARM-discovered resources because vault-discovered sub-resources don't carry ARM tags. Coverage includes IaaS VMs, SQL in IaaS VMs, SAP HANA in IaaS VMs, Azure File Shares, Blob Storage, ADLS Gen2, AKS, Managed Disks, PostgreSQL Flexible Server, Cosmos DB, and Elastic SAN.

Example CLI command

azmcp azurebackup governance find-unprotected \
  [--resource-type-filter <resource-type-filter>] \
  [--tag-filter <tag-filter>] \
  [--resource-group <resource-group>]
Parameter Type Required Description
resource-type-filter string No Resource types to filter (comma-separated).
tag-filter string No Tag-based filter in key=value format (for example, environment=production).
resource-group string No The Azure resource group name.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
❌ ✅ ❌ ✅ ❌ ❌

Governance: Configure immutability state

This tool configures the immutability state for a backup vault. Set the state to Disabled, Enabled, or Locked. Warning: Locked is irreversible.

Example CLI command

azmcp azurebackup governance immutability \
  --immutability-state <immutability-state> \
  --vault <vault> \
  --resource-group <resource-group> \
  [--vault-type <vault-type>]
Parameter Type Required Description
immutability-state string Yes Immutability state: Disabled, Enabled, or Locked (irreversible).
vault string Yes The name of the backup vault (Recovery Services vault or Backup vault).
resource-group string Yes The Azure resource group name.
vault-type string No The type of backup vault: rsv for a Recovery Services vault or dpp for a Backup vault (Data Protection Platform). The tool autodetects the type for existing vaults when you omit this parameter.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
✅ ✅ ❌ ❌ ❌ ❌

Governance: Configure soft delete

This tool configures soft-delete settings for a backup vault. Set the soft-delete state to AlwaysOn, On, or Off. Optionally, specify the soft-delete retention period in days (14 to 180). For example, enable soft delete On with a 30-day retention for the vault contosoBackupVault in the resource group rg-backup.

Example CLI command

azmcp azurebackup governance soft-delete \
  --soft-delete <soft-delete> \
  --vault <vault> \
  --resource-group <resource-group> \
  [--soft-delete-retention-days <soft-delete-retention-days>] \
  [--vault-type <vault-type>]
Parameter Type Required Description
soft-delete string Yes Soft-delete state: AlwaysOn, On, or Off.
vault string Yes The name of the backup vault (Recovery Services vault or Backup vault).
resource-group string Yes The Azure resource group name.
soft-delete-retention-days string No Soft delete retention period (14-180 days).
vault-type string No The type of backup vault: rsv for a Recovery Services vault or dpp for a Backup vault (Data Protection Platform). The tool autodetects the type for existing vaults when you omit this parameter.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
✅ ✅ ❌ ❌ ❌ ❌

Job: Get backup job information

This tool retrieves backup job information from a vault. When you specify the job ID, the tool returns detailed information about that job. The information includes operation type, status, start and end times, error codes, and data source details. When you omit the job ID, the tool lists all backup jobs in the vault.

Example CLI command

azmcp azurebackup job get \
  --vault <vault> \
  --resource-group <resource-group> \
  [--job <job>] \
  [--vault-type <vault-type>]
Parameter Type Required Description
vault string Yes The name of the backup vault (Recovery Services vault or Backup vault).
resource-group string Yes The Azure resource group name.
job string No The backup job ID.
vault-type string No The type of backup vault: rsv for a Recovery Services vault or dpp for a Backup vault (Data Protection Platform). The tool autodetects the type for existing vaults when you omit this parameter.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
❌ ✅ ❌ ✅ ❌ ❌

Policy: Create backup policy

This tool creates a backup policy for the workload type you specify and lets you set schedule and retention rules.

Example CLI command

azmcp azurebackup policy create \
  --policy <policy> \
  --workload-type <workload-type> \
  --vault <vault> \
  --resource-group <resource-group> \
  [--daily-retention-days <daily-retention-days>] \
  [--time-zone <time-zone>] \
  [--schedule-frequency <schedule-frequency>] \
  [--schedule-times <schedule-times>] \
  [--schedule-days-of-week <schedule-days-of-week>] \
  [--hourly-interval-hours <hourly-interval-hours>] \
  [--hourly-window-start-time <hourly-window-start-time>] \
  [--hourly-window-duration-hours <hourly-window-duration-hours>] \
  [--weekly-retention-weeks <weekly-retention-weeks>] \
  [--weekly-retention-days-of-week <weekly-retention-days-of-week>] \
  [--monthly-retention-months <monthly-retention-months>] \
  [--monthly-retention-week-of-month <monthly-retention-week-of-month>] \
  [--monthly-retention-days-of-week <monthly-retention-days-of-week>] \
  [--monthly-retention-days-of-month <monthly-retention-days-of-month>] \
  [--yearly-retention-years <yearly-retention-years>] \
  [--yearly-retention-months <yearly-retention-months>] \
  [--yearly-retention-week-of-month <yearly-retention-week-of-month>] \
  [--yearly-retention-days-of-week <yearly-retention-days-of-week>] \
  [--yearly-retention-days-of-month <yearly-retention-days-of-month>] \
  [--archive-tier-after-days <archive-tier-after-days>] \
  [--archive-tier-mode <archive-tier-mode>] \
  [--policy-sub-type <policy-sub-type>] \
  [--instant-rp-retention-days <instant-rp-retention-days>] \
  [--instant-rp-resource-group <instant-rp-resource-group>] \
  [--snapshot-consistency <snapshot-consistency>] \
  [--full-schedule-frequency <full-schedule-frequency>] \
  [--full-schedule-days-of-week <full-schedule-days-of-week>] \
  [--differential-schedule-days-of-week <differential-schedule-days-of-week>] \
  [--differential-retention-days <differential-retention-days>] \
  [--incremental-schedule-days-of-week <incremental-schedule-days-of-week>] \
  [--incremental-retention-days <incremental-retention-days>] \
  [--log-frequency-minutes <log-frequency-minutes>] \
  [--log-retention-days <log-retention-days>] \
  [--is-compression <is-compression>] \
  [--is-sql-compression <is-sql-compression>] \
  [--smart-tier <smart-tier>] \
  [--enable-snapshot-backup <enable-snapshot-backup>] \
  [--snapshot-instant-rp-retention-days <snapshot-instant-rp-retention-days>] \
  [--snapshot-instant-rp-resource-group <snapshot-instant-rp-resource-group>] \
  [--enable-vault-tier-copy <enable-vault-tier-copy>] \
  [--vault-tier-copy-after-days <vault-tier-copy-after-days>] \
  [--backup-mode <backup-mode>] \
  [--pitr-retention-days <pitr-retention-days>] \
  [--policy-tags <policy-tags>] \
  [--vault-type <vault-type>]
Parameter Type Required Description
policy string Yes The name of the backup policy.
workload-type string Yes Workload type: VM, SQL, SAPHANA, SAPASE, AzureFileShare (RSV types); AzureDisk, AzureBlob, AKS, ElasticSAN, PostgreSQLFlexible, ADLS, CosmosDB (DPP types). Also accepts aliases such as AzureVM and SQLDatabase.
vault string Yes The name of the backup vault (Recovery Services vault or Backup vault).
resource-group string Yes The Azure resource group name.
daily-retention-days string No Daily recovery point retention in days. Defaults to a data source-specific value if you don't specify one.
time-zone string No Windows time-zone identifier for the backup schedule (for example, UTC, Pacific Standard Time, India Standard Time). If you omit it, the schedule runs in UTC.
schedule-frequency string No Backup schedule frequency. RSV vaults accept Daily, Weekly, or Hourly. DPP (Backup) vaults accept ISO 8601 intervals: PT4H, PT6H, PT8H, PT12H, P1D, P1W, P2W, or P1M.
schedule-times string No Comma-separated list of backup times in 24h HH:mm format (for example, 02:00 or 02:00,14:00). Interpreted in --time-zone. Defaults to 02:00 UTC if you don't specify a value. Only the first time serves as the schedule start time.
schedule-days-of-week string No Comma-separated days of the week the backup should run (for example, Monday,Wednesday,Friday). Required for Weekly schedules.
hourly-interval-hours string No Interval in hours between hourly backups. Valid values: 4, 6, 8, 12. Applies only when --schedule-frequency is Hourly (RSV).
hourly-window-start-time string No Start time of the hourly backup window in 24h HH:mm format (for example, 08:00). Applies only when --schedule-frequency is Hourly (RSV).
hourly-window-duration-hours string No Duration of the hourly backup window in hours (for example, 12). Applies only when --schedule-frequency is Hourly (RSV).
weekly-retention-weeks string No Number of weeks to keep weekly recovery points. Required alongside --weekly-retention-days-of-week.
weekly-retention-days-of-week string No Comma-separated days of the week tagged for weekly retention (for example, Sunday or Saturday,Sunday). Required alongside --weekly-retention-weeks.
monthly-retention-months string No Number of months to keep monthly recovery points. Combine with either --monthly-retention-days-of-month (absolute) OR --monthly-retention-week-of-month + --monthly-retention-days-of-week (relative).
monthly-retention-week-of-month string No Which week of the month to tag for monthly retention: First, Second, Third, Fourth, or Last. Use with --monthly-retention-days-of-week (relative scheme).
monthly-retention-days-of-week string No Comma-separated days of the week for the monthly retention tag (for example, Sunday). Use with --monthly-retention-week-of-month (relative scheme).
monthly-retention-days-of-month string No Comma-separated days of the month for monthly retention (1 to 28 or Last; for example, 1,15,Last). Absolute scheme; mutually exclusive with --monthly-retention-week-of-month.
yearly-retention-years string No Number of years to keep yearly recovery points. Combine with --yearly-retention-months and either --yearly-retention-days-of-month (absolute) OR --yearly-retention-week-of-month + --yearly-retention-days-of-week (relative).
yearly-retention-months string No Comma-separated months tagged for yearly retention (for example, January or January,July).
yearly-retention-week-of-month string No Which week of the selected month or months to tag for yearly retention: First, Second, Third, Fourth, or Last. Use with --yearly-retention-days-of-week (relative scheme).
yearly-retention-days-of-week string No Comma-separated days of the week for the yearly retention tag (for example, Sunday). Use with --yearly-retention-week-of-month (relative scheme).
yearly-retention-days-of-month string No Comma-separated days of the selected month or months for yearly retention (1 to 28 or Last; for example, 1,Last). Absolute scheme; mutually exclusive with --yearly-retention-week-of-month.
archive-tier-after-days string No Move recovery points to the archive tier after this many days. Pair with --archive-tier-mode.
archive-tier-mode string No Archive tiering mode: TierAfter (always tier after --archive-tier-after-days) or CopyOnExpiry (copy to archive when the recovery point expires). Use --smart-tier for service-recommended tiering.
policy-sub-type string No RSV VM policy sub-type: Standard or Enhanced. Enhanced is required for hourly schedules and Trusted Launch VMs. RSV VM only.
instant-rp-retention-days string No Instant recovery point retention in days (1 to 30 for Standard, 1 to 7 for Enhanced). RSV VM only.
instant-rp-resource-group string No Resource group that hosts the instant recovery point snapshots. RSV VM only.
snapshot-consistency string No Snapshot consistency mode for VM backups: ApplicationConsistent or CrashConsistent. RSV VM only.
full-schedule-frequency string No Full backup schedule frequency for SQL/SAPHANA/SAPASE: Daily or Weekly. RSV VmWorkload only.
full-schedule-days-of-week string No Comma-separated days of the week for the Full backup (for example, Sunday). Required when --full-schedule-frequency is Weekly. RSV VmWorkload only.
differential-schedule-days-of-week string No Comma-separated days of the week for the Differential backup (for example, Monday,Thursday). RSV VmWorkload only.
differential-retention-days string No Retention period in days for Differential backups. RSV VmWorkload only.
incremental-schedule-days-of-week string No Comma-separated days of the week for the Incremental backup. RSV SAPHANA / SAPASE only.
incremental-retention-days string No Retention period in days for Incremental backups. RSV SAPHANA / SAPASE only.
log-frequency-minutes string No Transaction log backup frequency in minutes (for example, 15, 30, 60). RSV VmWorkload only.
log-retention-days string No Retention period in days for transaction log backups. RSV VmWorkload only.
is-compression string No Enable backup compression at the policy level. RSV VmWorkload only.
is-sql-compression string No Enable SQL Server on VM native backup compression. RSV SQL only.
smart-tier string No Enable smart-tiering (machine learning-based archive recommendation). RSV VM only. Equivalent to TieringMode=TierRecommended. Stays separate from --archive-tier-mode because it emits a structurally different tiering shape (Duration=0, DurationType=Invalid).
enable-snapshot-backup string No Enable snapshot/instance backups (HANA System Replication snapshot recovery points). RSV SAPHANA only.
snapshot-instant-rp-retention-days string No Snapshot instant recovery point retention range in days. RSV SAPHANA snapshot only.
snapshot-instant-rp-resource-group string No Resource group prefix for snapshot instant recovery points. RSV SAPHANA snapshot only.
enable-vault-tier-copy string No Enable vault-tier copy of operational store backups. DPP AzureDisk only.
vault-tier-copy-after-days string No Days after which an operational backup is copied to the vault tier. DPP AzureDisk only.
backup-mode string No Backup mode for storage workloads: Continuous (default for AzureBlob, ADLS) or Vaulted (discrete recovery points). DPP AzureBlob, AzureDataLakeStorage.
pitr-retention-days string No Point-in-time restore retention in days for continuous backups. DPP AzureBlob, AzureDataLakeStorage.
policy-tags string No Resource tags applied to the RSV backup policy as k1=v1,k2=v2. RSV only.
vault-type string No The type of backup vault: rsv for a Recovery Services vault or dpp for a Backup vault (Data Protection Platform). The tool autodetects the type for existing vaults when you omit this parameter.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
✅ ❌ ❌ ❌ ❌ ❌

Policy: Get policy

This tool retrieves backup policy information. The tool provides detailed information for a single policy when you specify the policy parameter. When you omit the policy parameter, the tool lists all the backup policies configured in the vault.

Example CLI command

azmcp azurebackup policy get \
  --vault <vault> \
  --resource-group <resource-group> \
  [--policy <policy>] \
  [--vault-type <vault-type>]
Parameter Type Required Description
vault string Yes The name of the backup vault (Recovery Services vault or Backup vault).
resource-group string Yes The Azure resource group name.
policy string No The name of the backup policy.
vault-type string No The type of backup vault: rsv for a Recovery Services vault or dpp for a Backup vault (Data Protection Platform). The tool autodetects the type for existing vaults when you omit this parameter.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
❌ ✅ ❌ ✅ ❌ ❌

Policy: Update policy

This tool modifies an existing Recovery Services vault backup policy. You can update the backup schedule time and daily retention days for VM, SQL, SAP HANA, and file share workload policies. The named policy must already exist in the vault.

Example CLI command

azmcp azurebackup policy update \
  --policy <policy> \
  --vault <vault> \
  --resource-group <resource-group> \
  [--schedule-time <schedule-time>] \
  [--daily-retention-days <daily-retention-days>] \
  [--vault-type <vault-type>]
Parameter Type Required Description
policy string Yes The name of the backup policy.
vault string Yes The name of the backup vault (Recovery Services vault or Backup vault).
resource-group string Yes The Azure resource group name.
schedule-time string No Backup time in HH:mm 24-hour format (for example, 02:00), interpreted in the policy's time zone.
daily-retention-days string No Daily recovery point retention in days. Defaults to a data source-specific value if you don't specify one.
vault-type string No The type of backup vault. Only rsv is supported for policy update; the tool autodetects the type when you omit this parameter. Policy update isn't supported for dpp (Backup vault) policies.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
✅ ✅ ❌ ❌ ❌ ❌

Protectable item: List protectable items

This tool lists items that you can back up (protectable items) in a Recovery Services vault. Examples include SQL databases and SAP HANA databases that the tool discovers on registered VMs. Use the tool to find databases and workloads available for backup protection. This tool supports Recovery Services vaults only. Data Protection Platform data sources use Resource Manager resource IDs for protection. Filter results by workload type, such as SQL or SAP HANA, or by container.

Example CLI command

azmcp azurebackup protectableitem list \
  --vault <vault> \
  --resource-group <resource-group> \
  [--workload-type <workload-type>] \
  [--container <container>] \
  [--vault-type <vault-type>]
Parameter Type Required Description
vault string Yes The name of the backup vault (Recovery Services vault or Backup vault).
resource-group string Yes The Azure resource group name.
workload-type string No Workload type: VM, SQL, SAPHANA, SAPASE, AzureFileShare (RSV types); AzureDisk, AzureBlob, AKS, ElasticSAN, PostgreSQLFlexible, ADLS, CosmosDB (DPP types). Also accepts aliases such as AzureVM and SQLDatabase.
container string No The RSV protection container name. Applies only to Recovery Services vaults.
vault-type string No The type of backup vault: rsv for a Recovery Services vault or dpp for a Backup vault (Data Protection Platform). The tool autodetects the type for existing vaults when you omit this parameter.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
❌ ✅ ❌ ✅ ❌ ❌

Protected item: Get information

Retrieves protected item information from a backup vault.

This tool returns detailed information about a single backup instance when you specify the protected item. Details include protection status, data source information, policy assignment, and last backup time. Specify the container for Recovery Services vault items. When you omit the protected item, the tool lists all protected items (backup instances) in the vault.

Example CLI command

azmcp azurebackup protecteditem get \
  --vault <vault> \
  --resource-group <resource-group> \
  [--protected-item <protected-item>] \
  [--container <container>] \
  [--vault-type <vault-type>]
Parameter Type Required Description
vault string Yes The name of the backup vault (Recovery Services vault or Backup vault).
resource-group string Yes The Azure resource group name.
protected-item string No The name of the protected item or backup instance.
container string No The RSV protection container name. Applies only to Recovery Services vaults.
vault-type string No The type of backup vault: rsv for a Recovery Services vault or dpp for a Backup vault (Data Protection Platform). The tool autodetects the type for existing vaults when you omit this parameter.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
❌ ✅ ❌ ✅ ❌ ❌

Protected item: Configure backup protection

Configure backup protection for an Azure resource by creating a protected item or a backup instance. This tool protects VMs, disks, file shares, SQL databases, SAP HANA databases, and other supported data sources. For VMs, provide the VM Resource Manager resource ID as Datasource ID. For SQL and SAP HANA workloads, specify the protectable item name as Datasource ID (for example, SAPHanaDatabase;instance;dbname) and specify the Container name. Specify the backup policy with the Policy parameter. The operation runs asynchronously, so monitor the protection job until it finishes.

Example CLI command

azmcp azurebackup protecteditem protect \
  --policy <policy> \
  --datasource-id <datasource-id> \
  --vault <vault> \
  --resource-group <resource-group> \
  [--datasource-type <datasource-type>] \
  [--aks-snapshot-resource-group <aks-snapshot-resource-group>] \
  [--aks-included-namespaces <aks-included-namespaces>] \
  [--aks-excluded-namespaces <aks-excluded-namespaces>] \
  [--aks-label-selectors <aks-label-selectors>] \
  [--aks-include-cluster-scope-resources <aks-include-cluster-scope-resources>] \
  [--protected-item <protected-item>] \
  [--container <container>] \
  [--vault-type <vault-type>]
Parameter Type Required Description
policy string Yes The name of the backup policy.
datasource-id string Yes The datasource identifier. For VM/FileShare/DPP workloads, use the Resource Manager resource ID (for example, /subscriptions/.../virtualMachines/myvm). For RSV in-guest workloads (SQL/SAPHANA), use the protectable item name from protectableitem list (for example, SAPHanaDatabase;instance;dbname).
vault string Yes The name of the backup vault (Recovery Services vault or Backup vault).
resource-group string Yes The Azure resource group name.
datasource-type string No The workload type hint: VM, SQL, SAPHANA, SAPASE, AzureFileShare (RSV types); AzureDisk, AzureBlob, AKS, ElasticSAN, PostgreSQLFlexible, ADLS, CosmosDB (DPP types). Also accepts aliases such as AzureVM and SQLDatabase.
aks-snapshot-resource-group string No Resource group that stores the AKS volume snapshots that Backup creates. DPP AKS only.
aks-included-namespaces string No Comma-separated list of namespaces to include in the AKS backup policy default scope. DPP AKS only.
aks-excluded-namespaces string No Comma-separated list of namespaces to exclude from the AKS backup policy default scope. DPP AKS only.
aks-label-selectors string No Comma-separated label selectors (for example, app=frontend,tier=web) that apply to the AKS backup policy default scope. DPP AKS only.
aks-include-cluster-scope-resources string No Include cluster-scoped resources in the AKS backup policy. DPP AKS only.
protected-item string No The name of the protected item or backup instance.
container string No The RSV protection container name. Applies only to Recovery Services vaults.
vault-type string No The type of backup vault: rsv for a Recovery Services vault or dpp for a Backup vault (Data Protection Platform). The tool autodetects the type for existing vaults when you omit this parameter.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
✅ ❌ ❌ ❌ ❌ ❌

Protected item: Restore soft-delete item

This tool restores a soft-deleted backup item to an active protection state. It helps you recover accidentally deleted backups or protected items. For Recovery Services vaults and Backup vaults, specify the data source Resource Manager resource ID with the datasource-id parameter. Optionally, specify the container parameter for Recovery Services vault workload items such as SQL or SAP HANA. The operation runs asynchronously, and you monitor progress with azurebackup job get.

Example CLI command

azmcp azurebackup protecteditem undelete \
  --datasource-id <datasource-id> \
  --vault <vault> \
  --resource-group <resource-group> \
  [--container <container>] \
  [--vault-type <vault-type>]
Parameter Type Required Description
datasource-id string Yes The datasource identifier. For VM/FileShare/DPP workloads, use the Resource Manager resource ID (for example, /subscriptions/.../virtualMachines/myvm). For RSV in-guest workloads (SQL/SAPHANA), use the protectable item name from protectableitem list (for example, SAPHanaDatabase;instance;dbname).
vault string Yes The name of the backup vault (Recovery Services vault or Backup vault).
resource-group string Yes The Azure resource group name.
container string No The RSV protection container name. Applies only to Recovery Services vaults.
vault-type string No The type of backup vault: rsv for a Recovery Services vault or dpp for a Backup vault (Data Protection Platform). The tool autodetects the type for existing vaults when you omit this parameter.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
✅ ✅ ❌ ❌ ❌ ❌

Recovery point: Get recovery point information

This tool retrieves recovery point information for a protected item. When you specify the recovery point, the tool returns detailed information about that recovery point, including time and type. When you omit the recovery point, the tool lists all available recovery points for the protected item.

Example CLI command

azmcp azurebackup recoverypoint get \
  --protected-item <protected-item> \
  --vault <vault> \
  --resource-group <resource-group> \
  [--container <container>] \
  [--recovery-point <recovery-point>] \
  [--vault-type <vault-type>]
Parameter Type Required Description
protected-item string Yes The name of the protected item or backup instance.
vault string Yes The name of the backup vault (Recovery Services vault or Backup vault).
resource-group string Yes The Azure resource group name.
container string No The RSV protection container name. Applies only to Recovery Services vaults.
recovery-point string No The recovery point ID.
vault-type string No The type of backup vault: rsv for a Recovery Services vault or dpp for a Backup vault (Data Protection Platform). The tool autodetects the type for existing vaults when you omit this parameter.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
❌ ✅ ❌ ✅ ❌ ❌

Security: Configure encryption

This tool configures customer-managed key (CMK) encryption on a backup vault by using a key from Azure Key Vault. It supports both Recovery Services vaults and Backup vaults (DPP). The vault's managed identity must have the Key Vault Crypto Service Encryption User role on the key vault. Use identity-type to specify SystemAssigned or UserAssigned identity. Provide user-assigned-identity-id when you use a user-assigned identity.

Example CLI command

azmcp azurebackup security configure-encryption \
  --key-vault-uri <key-vault-uri> \
  --key-name <key-name> \
  --identity-type <identity-type> \
  --vault <vault> \
  --resource-group <resource-group> \
  [--key-version <key-version>] \
  [--user-assigned-identity-id <user-assigned-identity-id>] \
  [--vault-type <vault-type>]
Parameter Type Required Description
key-vault-uri string Yes Key Vault URI (for example, https://kv-security-prod.vault.azure.net/).
key-name string Yes Name of the encryption key in the Key Vault.
identity-type string Yes Managed identity type: SystemAssigned, UserAssigned, SystemAssigned,UserAssigned, or None.
vault string Yes The name of the backup vault (Recovery Services vault or Backup vault).
resource-group string Yes The Azure resource group name.
key-version string No Specific key version. Omit to always use the latest version.
user-assigned-identity-id string No Resource Manager resource ID of the user-assigned managed identity for Key Vault access. Required when --identity-type is UserAssigned.
vault-type string No The type of backup vault: rsv for a Recovery Services vault or dpp for a Backup vault (Data Protection Platform). The tool autodetects the type for existing vaults when you omit this parameter.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
✅ ✅ ❌ ❌ ❌ ❌

Security: Configure multiuser authorization

This tool configures MUA on a backup vault by linking or unlinking a Resource Guard instance. Provide a Resource Guard ID to enable MUA, which protects critical operations such as disabling soft delete, removing immutability, and stopping protection. These operations require approval from a security admin with permissions on the Resource Guard instance. Omit the Resource Guard ID to disable MUA. Disabling MUA is a protected operation that requires the Backup MUA Operator role on the Resource Guard instance.

Example CLI command

azmcp azurebackup security configure-mua \
  --vault <vault> \
  --resource-group <resource-group> \
  [--resource-guard-id <resource-guard-id>] \
  [--vault-type <vault-type>]
Parameter Type Required Description
vault string Yes The name of the backup vault (Recovery Services vault or Backup vault).
resource-group string Yes The Azure resource group name.
resource-guard-id string No ARM resource ID of the Resource Guard to link for multiuser authorization (for example, /subscriptions/.../resourceGroups/.../providers/Microsoft.DataProtection/resourceGuards/myGuard).
vault-type string No The type of backup vault: rsv for a Recovery Services vault or dpp for a Backup vault (Data Protection Platform). The tool autodetects the type for existing vaults when you omit this parameter.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
✅ ✅ ❌ ❌ ❌ ❌

Vault: Create backup vault

This tool creates a new backup vault. Specify the vault type as rsv for a Recovery Services vault or dpp for a Backup vault (Data Protection Platform). For dpp vaults, the tool enables a system-assigned managed identity by default. The vault authenticates to protected data sources such as storage accounts, disks, and PostgreSQL flexible servers. You can change the identity type later. To use ReadAccessGeoZoneRedundant, create the vault with a supported redundancy type and then update it. After creation, the tool returns the vault details.

Example CLI command

azmcp azurebackup vault create \
  --location <location> \
  --vault <vault> \
  --resource-group <resource-group> \
  [--sku <sku>] \
  [--storage-type <storage-type>] \
  [--vault-type <vault-type>]
Parameter Type Required Description
location string Yes The Azure region (for example, eastus, westus2).
vault string Yes The name of the backup vault (Recovery Services vault or Backup vault).
resource-group string Yes The Azure resource group name.
sku string No The vault SKU. For Recovery Services vaults, accepted values are Standard and RS0.
storage-type string No Storage redundancy: GeoRedundant, LocallyRedundant, or ZoneRedundant.
vault-type string No The type of backup vault: rsv for a Recovery Services vault or dpp for a Backup vault (Data Protection Platform). The tool autodetects the type for existing vaults when you omit this parameter.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
✅ ❌ ❌ ❌ ❌ ❌

Vault: Get backup vault

This tool retrieves backup vault information. When you specify a vault and a resource group, the tool returns detailed information about that vault, including vault type, location, SKU, and storage redundancy. If you omit those parameters, the tool lists all backup vaults in the subscription, including Recovery Services vaults and Backup vaults (Data Protection Platform). To narrow the list, filter results by vault type rsv or dpp, or by resource group. Use the --expand parameter to include extra vault posture fields, such as the encryption key URI, cross-region restore state, and the multiuser authorization (MUA) resource guard link, in the response.

Example CLI command

azmcp azurebackup vault get \
  [--vault <vault>] \
  [--vault-type <vault-type>] \
  [--resource-group <resource-group>] \
  [--expand <expand>]
Parameter Type Required Description
vault string No The name of the backup vault (Recovery Services vault or Backup vault).
vault-type string No The type of backup vault: rsv for a Recovery Services vault or dpp for a Backup vault (Data Protection Platform). The tool autodetects the type for existing vaults when you omit this parameter.
resource-group string No The Azure resource group name.
expand string No Comma-separated list of extra vault posture fields to include: security, mua, or all.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
❌ ✅ ❌ ✅ ❌ ❌

Vault: Update vault settings

This tool updates vault-level settings for a Recovery Services vault or Backup vault. You can change storage redundancy, enable or disable soft delete, configure immutability, and set the managed identity type.

Example CLI command

azmcp azurebackup vault update \
  --vault <vault> \
  --resource-group <resource-group> \
  [--redundancy <redundancy>] \
  [--soft-delete <soft-delete>] \
  [--soft-delete-retention-days <soft-delete-retention-days>] \
  [--immutability-state <immutability-state>] \
  [--identity-type <identity-type>] \
  [--tags <tags>] \
  [--vault-type <vault-type>]
Parameter Type Required Description
vault string Yes The name of the backup vault (Recovery Services vault or Backup vault).
resource-group string Yes The Azure resource group name.
redundancy string No Storage redundancy: GeoRedundant, LocallyRedundant, ZoneRedundant, or ReadAccessGeoZoneRedundant.
soft-delete string No Soft-delete state: AlwaysOn, On, or Off.
soft-delete-retention-days string No Soft delete retention period (14-180 days).
immutability-state string No Immutability state: Disabled, Enabled, or Locked (irreversible).
identity-type string No Managed identity type: SystemAssigned, UserAssigned, SystemAssigned,UserAssigned, or None.
tags string No Resource tags as JSON key-value object.
vault-type string No The type of backup vault: rsv for a Recovery Services vault or dpp for a Backup vault (Data Protection Platform). The tool autodetects the type for existing vaults when you omit this parameter.

Tool annotation hints:

Destructive Idempotent Open World Read Only Secret Local Required
✅ ✅ ❌ ❌ ❌ ❌

Related content

  • Last updated on